From 1ea8746cf39c18235ea446b5f01479b3cf6600df Mon Sep 17 00:00:00 2001 From: KimGLee <05_bolster_inkling@icloud.com> Date: Sat, 22 Aug 2026 00:03:49 +0800 Subject: [PATCH 1/4] Separate adopter Standards state from history --- README.md | 44 +- Tools/README.md | 65 +-- Tools/adopt_standards.py | 72 ++- Tools/apply_profile_adoption.py | 443 ++++++++---------- Tools/check_boundary_contract.py | 2 +- Tools/check_page_contract.py | 2 +- Tools/check_proof.py | 6 +- Tools/check_queue.py | 200 +++++--- Tools/check_structure.py | 2 +- Tools/compiled/cli-contract.yaml | 96 ++-- .../host-configs/claude-code.mcp.json | 2 +- Tools/compiled/host-configs/codex.config.toml | 4 +- .../host-configs/dsh-profile-patch.yaml | 2 +- Tools/compiled/host-configs/dsh.env | 4 +- .../compiled/host-configs/kimi-code.mcp.json | 2 +- Tools/compiled/mcp-tools.json | 2 +- .../compiled/metadata-execution-contract.json | 2 +- Tools/compose_page_contract.py | 4 +- Tools/compose_vocab.py | 13 +- Tools/init_state.py | 118 ++++- Tools/migrate_standards_state.py | 172 +++++++ Tools/profile_admission.py | 39 +- Tools/profile_onboarding_status.py | 69 ++- Tools/render_boundary_projection.py | 2 +- Tools/render_structure_projection.py | 2 +- .../profile_adoption_plan.template.yaml | 36 +- Tools/schemas/receipt.template.jsonl | 18 +- .../standards_adoption_plan.template.yaml | 4 +- Tools/schemas/standards_state.template.yaml | 13 + Tools/stamp_cards.py | 51 +- Tools/standards_state.py | 173 +++++++ Tools/tests/profile_fixture.py | 25 +- Tools/tests/test_adopt_standards.py | 88 ++-- Tools/tests/test_apply_profile_adoption.py | 87 ++-- Tools/tests/test_check_queue.py | 27 +- Tools/tests/test_migrate_standards_state.py | 80 ++++ Tools/tests/test_profile_admission.py | 33 +- Tools/tests/test_profile_onboarding_status.py | 49 +- Tools/tests/test_queue_proof.py | 62 +-- Tools/tests/test_required_queue_e2e.py | 22 +- Tools/tests/test_runtime_safety.py | 36 +- Tools/tests/test_standards_state.py | 67 +++ Tools/tests/test_update_queue.py | 2 +- Tools/tests/test_vocab_artifact_integrity.py | 31 +- kernel/Cards/Card Index.md | 6 +- kernel/Cards/R01 Core Bootstrap Card.md | 13 +- .../Cards/R02 Single Note Authoring Card.md | 4 +- kernel/Cards/R03 Module Build Card.md | 4 +- kernel/Cards/R05 Expression Layer Card.md | 4 +- .../Cards/R06 Migration and Refactor Card.md | 4 +- .../Cards/R07 Long-running Execution Card.md | 8 +- kernel/Cards/R08 Audit and Completion Card.md | 4 +- kernel/Cards/R09 Standards Governance Card.md | 8 +- kernel/Cards/R10 Maintenance Run Card.md | 11 +- .../R11 Large-scale Work Admission Card.md | 6 +- ...R12 Targeted and Specialized Audit Card.md | 4 +- .../03 Standards Governance.md | 59 ++- .../10 Batch Execution Checklist.md | 2 +- .../12 Control Registry.md | 2 +- .../13 Runtime Admission and Recovery.md | 29 +- .../16 Leaf Module Size Register.md | 10 +- .../17 Profile Dependency Closure.md | 2 +- kernel/K00 Standards Overview.md | 16 +- .../05 Automated and Manual Checks.md | 2 +- .../10 Standards Version Adoption.md | 23 +- .../17 Gate Receipt Payload Contract.md | 2 +- .../01 Runtime State Model and Namespace.md | 12 +- .../14 Interruption Recovery and Rollover.md | 7 +- ...15 Standards Adoption State Transaction.md | 26 +- .../Read Sets/R01 Core Bootstrap Read Set.md | 2 +- .../R09 Standards Governance Read Set.md | 6 +- .../Read Sets/R10 Maintenance Run Read Set.md | 9 +- ...R11 Large-scale Work Admission Read Set.md | 2 +- profiles/examples/agent-atlas/README.md | 2 +- profiles/examples/minimal-notes/README.md | 2 +- profiles/examples/worked-planning/README.md | 2 +- 76 files changed, 1653 insertions(+), 913 deletions(-) create mode 100644 Tools/migrate_standards_state.py create mode 100644 Tools/schemas/standards_state.template.yaml create mode 100644 Tools/standards_state.py create mode 100644 Tools/tests/test_migrate_standards_state.py create mode 100644 Tools/tests/test_standards_state.py diff --git a/README.md b/README.md index 8bb9c9d..75025d3 100644 --- a/README.md +++ b/README.md @@ -115,13 +115,15 @@ configuration and does not contain the Atlas knowledge corpus. ## Adopter Runtime State -Long-running, resumable, or multi-batch work uses one fixed namespace in the -adopting repository. Every task first checks whether that namespace already -exists, because a seemingly bounded new request may enter a repository whose -earlier persistent task was interrupted: +Long-running, resumable, or multi-batch work uses one fixed task namespace in +the adopting repository. Every task first checks whether `.cambium/state/` +already exists, because a seemingly bounded new request may enter a repository +whose earlier persistent task was interrupted. Governance may already exist +without a task runtime: ```text .cambium/ +├── governance/ # canonical current Standards/Profile identity ├── state/ # Coverage, Required Queue, and Progress ├── work_specs/ # immutable restricted-YAML contracts for complex batches ├── deltas/ # worker deltas and restricted-YAML controlled-operation plans @@ -139,8 +141,9 @@ planned rather than shipped, and this repository carries none today (see its own runtime state with `Tools/init_state.py` after selecting a profile and defining a task. The tool requires an explicit objective and exclusions, does not invent Required work, -and does not overwrite any existing `.cambium/` namespace. -If the namespace already exists, a restarted or newly assigned Agent first +and does not overwrite any existing `.cambium/state/` task runtime; a valid +governance/history namespace is preserved. +If task state already exists, a restarted or newly assigned Agent first runs `Tools/check_queue.py . --resume-status` to discover the recorded task, its `build` or `maintenance` completion semantics, checkpoint binding, latest task transition, in-flight batches, pending control inputs/deltas, the @@ -301,14 +304,14 @@ in [`profiles/README.md`](profiles/README.md). python3 Tools/apply_profile_adoption.py . --plan .yaml --apply ``` - The transaction instantiates the four K00/03 values, creates the first - Change Summary entry, composes the profile vocabulary and the frontmatter - page contract, stamps the Runtime Cards for the adopted version, and + The transaction creates the canonical adopter Standards state, appends the + first immutable adoption receipts, composes the Profile vocabulary and the + frontmatter page contract, stamps the Runtime Cards for the adopted version, and re-verifies the gates; a failure at any step restores the previous control plane rather than leaving a partial adoption. The same steps remain runnable by hand (`compose_vocab.py`, `compose_page_contract.py`, `stamp_cards.py --set-version` / `--check`) as the no-agent fallback. An - existing `.cambium/` runtime is refused here: an active task adopts through + existing `.cambium/state/` task runtime is refused here: an active task adopts through `adopt_standards.py` (next section). 5. Complete the R09 governance gates before beginning corpus-content work. [`Tools/README.md`](Tools/README.md) documents the individual commands, @@ -348,7 +351,7 @@ ordinary authoring work. Creating the first pages of an empty corpus is bounded authoring work. It is not the large-scale creation `K00/13` admits, so it selects neither R11 nor -Corpus Planning, and — being bounded — it initializes no `.cambium/` runtime +Corpus Planning, and — being bounded — it initializes no `.cambium/state/` task runtime state at all. 1. Adopt the profile through R09. @@ -435,7 +438,7 @@ guessing a verdict. ## Adopt A New Standards Version Into An Active Task R09 governs the Standards revision and records its exact changed predicates. -When an existing `.cambium/` task still freezes the prior Standards/Profile +When an existing `.cambium/state/` task still freezes the prior Standards/Profile identity, R09 produces one restricted-YAML plan using [`Tools/schemas/standards_adoption_plan.template.yaml`](Tools/schemas/standards_adoption_plan.template.yaml): @@ -444,7 +447,8 @@ identity, R09 produces one restricted-YAML plan using ``` That plan is the task's canonical machine revision record. It binds the -complete approved K00/03 bytes, deterministic after snapshots of `kernel/` and +complete approved K00/03 rule bytes, the exact canonical adopter-state +before-image, deterministic after snapshots of `kernel/` and the selected Profile directory, and the exact changed-predicate, invalidated-evidence dimension/boundary, and rerun scope. There is no second revision YAML or prose adoption copy. @@ -504,17 +508,19 @@ route, profile bindings, and source modules required by the current task. Combine additional routes only when their Card Index triggers apply; they do not replace the route for the work itself. -For every task, first inspect the target repository for `.cambium/`. If it -exists, do not write content or state and do not initialize or overwrite it: -inspect and reconcile its current task first. If it is absent, only a -long-running, resumable, or multi-batch task initializes it; bounded work -continues without creating empty runtime state. +For every task, first inspect the target repository for `.cambium/state/`. If +it exists, do not write content or task state and do not initialize or +overwrite it: inspect and reconcile its current task first. If task state is +absent, only a long-running, resumable, or multi-batch task initializes it; +bounded work continues without creating empty task state. A valid +`.cambium/governance/` and adoption history may already exist and are +preserved. ```text # Existing runtime state: always inspect before writing. python3 Tools/check_queue.py . --resume-status -# No .cambium/ exists and persistent state applies: initialize once. +# No .cambium/state/ exists and persistent state applies: initialize once. python3 Tools/init_state.py . \ --task-id YOUR_TASK \ --objective "State the concrete outcome this task must achieve" \ diff --git a/Tools/README.md b/Tools/README.md index b0e8c94..46b23f1 100644 --- a/Tools/README.md +++ b/Tools/README.md @@ -82,7 +82,7 @@ returned Addendum is bound to the parent Bundle and refuses source drift. | `check_proof.py` | Terminal Proof Gate producer 1.17.0 (K12/16): field completeness; canonical, non-symlinked Coverage/Progress/Queue state; exact candidate-state fingerprints, or after completion the same pre-complete Progress fingerprint bound through the latest task-transition receipt and its current after-image; task/scope/contract/Standards/profile agreement plus exact equality of all five selection lists with the frozen Progress Task Contract; no pending Guidance/Amendment; current Queue revisions, zero remaining work, live completion gate and Coverage gaps; selected profile loadability; required terminal R01/R12/R08 selection and exact R01-R13 route/Card/Read-Set registry agreement; passed reconciliation/QA/review results; and complete receipt evidence for the seven base dimensions plus exactly the selected Profile registry extensions targeting `receipt`. In root mode one authorized Profile view and one runtime result supply admission, active K00 identity, extension-dimension enumeration, complete Profile snapshot, typed-contract fingerprint, and the fingerprint of the three root-owned profile-load inputs; Queue and Corpus consumers reuse those objects without rerunning the producer. The final boundary rebinds the Profile, K00, three state files, canonical profile-load inputs, and whole repository. The pass receipt carries all three Profile fingerprints plus `repository_snapshot_sha256`, so a later K, Card, Read Set, Profile, or Tool revision cannot be consumed as the old Proof. Unregistered dimension keys and receipt lists under `review`-only dimensions fail, and every cited receipt must remain in the Standards-adoption-filtered current catalog—historical evidence is retained but cannot authorize a new proof. It rejects a Progress contract whose `completion_semantics` is `maintenance`; without `--root`, it is structural lint only | `python3 Tools/check_proof.py .cambium/receipts/terminal-proof.yaml --root . --progress-ledger .cambium/state/progress_ledger.yaml --ledger .cambium/state/coverage_ledger.yaml --receipts .cambium/receipts/terminal.jsonl` | | `check_corpus_plan.py` | Corpus Planning structural/reconciliation gate and Agent query interface 1.7.0: resolves the explicit or Progress-selected Profile; validates the three closed restricted-YAML planning contracts, explicit IDs/relations, Profile Scope, scale/evidence links, and Gap promotion handoff. Structural receipts carry Gate ID `corpus-plan-structure`. `--json` exposes `structural_reconciliation_valid` and the separately resolved `semantic_acceptance` status; it emits no ambiguous aggregate `valid` field and persists no report. The tool never infers relations or makes the semantic decision | `python3 Tools/check_corpus_plan.py . --json` | | `record_corpus_acceptance.py` | Sole `corpus-plan-semantic-acceptance` producer. Consumes one closed restricted-YAML plan directly under `.cambium/deltas/corpus-plan-acceptances/`; requires every current Capability ID exactly once in Matrix order, the Profile-bound authority Role and decision scope, and explicit accepted/rejected decisions. Dry-run by default. `--apply` appends a fresh structural receipt and a distinct semantic JSONL receipt bound to the plan, Profile/slot/Scope, three planning artifacts, canonical runtime state, repository snapshot, authority, and exact decisions. It creates no Markdown projection | `python3 Tools/record_corpus_acceptance.py . --plan .cambium/deltas/corpus-plan-acceptances/CPA-001.yaml --actor-role --apply` | -| `init_state.py` | Create an adopter's empty `.cambium/` namespace (producer 1.3.0), including `work_specs/`, and the three canonical state files. Dry-run by default; `--apply` stages and reparses a complete tree before one atomic no-replace rename, requires the caller to choose `--completion-semantics build` or `maintenance`, records the task objective plus repeatable explicit exclusions alongside Standards/profile identity, requires the candidate selected Profile to pass the same `profile-load` closure used at public Queue admission, and never invents Required work. The Profile snapshot, typed-contract fingerprint, and resolved Profile override are compared at admission and immediately before and after publication; a staged shared-writer lock publishes with the namespace, post-publication drift atomically withdraws it, and an unprovable rollback retains the exact recovery lock. Any pre-existing `.cambium/`—including an empty directory that wins a publication race—is preserved; the diagnostic directs the operator to `check_queue.py --resume-status` rather than overwriting it | `python3 Tools/init_state.py . --task-id TASK --objective "Concrete outcome" --exclude "Out-of-scope boundary" --completion-semantics build --scope-version s1 --standards-version VERSION --profile-manifest profiles/my-profile/profile.md --apply` | +| `init_state.py` | Create an adopter's empty task runtime (producer 1.4.0), including `work_specs/` and the three task Ledgers. Dry-run by default. A new adopter already has `.cambium/governance/standards_state.yaml` and may have adoption receipts; the writer preserves both and publishes the task directories beside them under the shared lock. Existing `.cambium/state/`, an unsafe namespace, Profile/state drift, or partial publication fails closed and rolls back; no Required work is invented | `python3 Tools/init_state.py . --task-id TASK --objective "Concrete outcome" --exclude "Out-of-scope boundary" --completion-semantics build --scope-version s1 --standards-version VERSION --profile-manifest profiles/my-profile/profile.md --apply` | | `apply_task_plan.py` | Sole writer of the initial planning transaction 1.2.0 (K13/18). `init_state.py` leaves the Task Contract's five selection fields, Coverage, and the Queue empty because it infers nothing; this tool fills the first two from one operator-confirmed restricted-YAML plan under `.cambium/deltas/task-plans/`, so those first values are never hand-edited. Dry-run by default. The plan names routes, not paths: `selected_card_paths`, `selected_read_sets`, and `loaded_module_paths` are resolved from `selected_route_ids` through the same canonical Card/Read Set indexes `check_proof` binds at Terminal, then transitively closed over loading boundaries, because selecting R01 alone reaches every other route and well over a hundred modules and a hand-typed list would be a declaration nobody checked; a path the plan does list is kept and closed over, which is how a profile supplemental Read Set is selected. The derived declaration must then satisfy `check_queue`'s own closure findings, which K00/15 makes an admission judgment rather than a live error precisely because a plan is still writable. It fails closed on an unknown or missing plan field, a `before` SHA-256 that does not match current Coverage/Queue/Progress bytes, a disagreeing task ID, a `task_state` other than `planned`, an already populated Coverage or Queue, an unfilled `TODO(plan)` sentinel, a current runtime that does not validate, a route absent from the registry, a Card whose route is not selected, a Read Set closure that does not resolve, Coverage the Queue compiler rejects, or a proposed after-image that fails `check_queue`. It compiles the Queue in memory only to prove one is derivable and to report its size; it writes no Queue bytes, because before first materialization Coverage and the Contract are adopter inputs while the Queue crossing that line is materialization itself, which `compile_queue --apply` owns. The state it leaves is the unmaterialized runtime that `check_queue`'s own `allow_unmaterialized_queue` names and that `compile_queue` sets to read it; both the dry run and the commit print the exact compiler command with the untouched Queue revision and fingerprint filled in. At founding it derives legacy machine-managed values from the exact page snapshots, records them as `legacy-unverified` Coverage observations, and removes the unauthoritative page copies in the same guarded transaction. Writes Coverage and Progress under the shared state-writer lock after re-verifying the before images, appends one commit receipt, and restores the before images plus an abort receipt on any failure after the first replacement. Re-applying the same plan bytes resumes an interruption; a different plan over an already-planned runtime is refused. The initial contract may carry the closed `amendment_authority` block; absent or `user-only` is the safe default, and delegated mode names only registered bounded change classes. The receipt carries no Gate ID: the state it writes is consumed by gates that already exist | `python3 Tools/apply_task_plan.py . --plan .cambium/deltas/task-plans/TP-001.yaml --apply` | | `apply_contract_amendment.py` | Guarded writer 1.1.0 for the two closed non-scope Task Contract fields the runtime supports (K13/06 Contract Amendment; field shape owner K13/02): `policy_exceptions` and `amendment_authority`. Consumes one confirmed restricted-YAML plan under `.cambium/deltas/contract-amendments/`; no pending phase -- it validates the complete after-image (including the K13/02 exception shape and the proposed runtime under `check_queue` with its own commit receipt as the anchor event) and commits Queue + Progress under the shared writer lock, or writes nothing. Advances `contract_version` and the Queue revision exactly once; changes no scope, batch structure, or lifecycle; integrator-only on apply. A schema-2 plan supplies both complete after-images; `changed_contract_fields` records which actually moved. The verified `contract-amendment` row it appends binds plan path/SHA and the commit receipt, and the contract anchor chain follows the fingerprint change instead of failing closed. Every exception for a registered policy must carry the CURRENT effective-policy fingerprint (`kblib.effective_priority_policy`; the refusal prints the expected value -- it is not computable by hand), and the effective ceilings -- exception where granted, standing quota where not -- must jointly stay strictly below 100 (K00/07). Refuses while any batch is `merge-ready` (the Queue-revision bump would strand its `delta_apply` binding); re-resolves the policy and re-verifies the plan bytes inside the commit lock; participates in the generic writer recovery protocol (`receipt_id`/`receipt_path`/`transaction_phase` in the lock metadata), and an uncertain receipt append retains the lock. Re-applying needs a fresh plan against the moved runtime; an exception is removed by confirming a plan whose after list no longer carries it | `python3 Tools/apply_contract_amendment.py . --plan .cambium/deltas/contract-amendments/CA-001.yaml --actor-role integrator --apply` | | `check_queue.py` | Required Queue Gate producer 1.23.0 (K13/08): validates schema, manifests, Coverage projection, dependencies, lifecycle/task receipts, holds, confirmations, hash-bound complex-batch Work Specs, deltas, concurrency, Progress revisions/fingerprint, paths, readiness, and terminal count. For current Standards revalidation it validates K00/12's closed capability registry, projects semantic leaves to their owner Gates, accepts raw receipts only for the due immediate-owner set, and records native owners as deferred to the transition that already owns them; historical plans and consumed aggregates keep producer-era semantics, including both the raw affected-gate union and boundary-level required gates recorded by pre-1.6 adoption producers. It also derives the live Task Contract's transitive Read Set closure: every referenced Read Set must be declared, kernel/profile types and namespaces must agree with the selected Profile and route IDs, and every ordinary boundary target must occur in `loaded_module_paths`; Profile-owned contract dependencies are authorized by `profile-load` and are not added to that kernel load list. Both the public R01 Queue admission and the lower-level runtime validator require the complete selected-Profile closure by default, so ordinary writers cannot bypass `profile-load`. The sole smaller identity/sentinel escape is an explicit `adopt_standards.py` option for its persisted current/before read; it is rejected for state overrides or pending receipts, and every candidate after-image remains under full `profile-load`. Unsafe or non-UTF-8 inputs fail closed. The hot receipt catalog never deserializes `.cambium/receipts/cold/` (K12/07): the cold manifest and index load instead. What sealing retires is that deserialization, not integrity -- every run re-hashes every sealed segment against the manifest, proves every projection against the exact sealed line it names, proves both cold registers against the seal receipt that wrote them, and fails closed on an unreferenced segment, an unfinished seal transaction, or a sealed row that still has a hot twin. Rows of a seal whose binding does not hold -- including one produced by an unsupported sealing protocol, or whose segment hash failed -- never enter the catalog at all. Cold paths may not traverse a symlink or carry a second hard link, and a close attestation's born-cold candidate evidence is compared against the hash it bound, not just its length. A sealed receipt then satisfies existence and the closed-bundle identity branch through its thin projection, and a consumer needing live field revalidation of a sealed body fails closed unless it has an explicit sealed branch. The Standards-revalidation consumption replay is such a branch: it resolves the aggregate a Queue transition consumed from the segment that receipt's verified projection names, re-proving the record's own hash at the read, because the consumed keys live in `revalidation_bindings` and the retraction test reads `invalidated_by` and no projection carries either. An aggregate a recorded transition consumed but that resolves in neither namespace fails the run closed rather than reopening a discharged obligation. `--require-complete` is the build-closure Queue gate, so a Terminal Proof cannot authorize an under-declared live load set. `--require-maintenance-complete` additionally consumes current budget-manifest-closed, Coverage-ledger-advanced, and watermark-advanced receipts; reconciles the manifest's complete selected/deferred candidate partition with Coverage and the Queue manifest union; enforces consecutive-deferral disposition; and binds the maintenance pass to all three current state objects. `--resume-status` reports objective/exclusions, completion semantics, three live SHAs, checkpoint/task history, Work Spec bindings, maintenance candidate SHA/partition/prior gate, controls, the applicable completion block, locks, and an exact `next_action`. Valid interrupted delta phases become `admit-delta:` or `apply-delta:`; an applied batch without a current close bundle becomes `run-batch-close-gate:`, while a recovered current bundle becomes `close-applied-batch::::` plus an exact copyable close command. Current close attestations also validate the `exact-carry-v1` baseline plus carried/fresh partitions and their born-cold evidence; historical Queue transitions replay producer-era protocols while new ones require update_queue/1.5.0 receipts, and historical closed deltas replay producer-era protocols while new applies require apply_delta/1.6.0. A writer lock always takes recovery priority; inconsistent evidence becomes `repair-runtime` only when no interrupted writer must first be reconciled | `python3 Tools/check_queue.py . --resume-status` | @@ -93,13 +93,14 @@ returned Addendum is bound to the parent Bundle and refuses source drift. | `update_queue.py` | Lifecycle writer 1.8.0, dry-run-first, integrator-only lifecycle/hold transition with legal-state enforcement, current contract-conformant gate/confirmation/batch receipts, exact managed delta validation and frozen SHA, optimistic revision/SHA checks, the shared writer lock, rollback, result-state revalidation, and before/after receipt history. Queue writes require task state `active`; the first open atomically invokes the task-state owner for `planned -> active`. The `open -> merge-ready` edge proves and binds the prospective routed-gap settlement before freezing the Delta. Opening freezes the exact semantic-content baseline for every manifest page. Close requires the exact `apply_delta` receipt, derives Coverage `next_batch`, consumes one exact-content review receipt per page, and commits `last_reviewed` owner records plus page projections in the same transaction. Cancellation goes through a registered `apply_amendment.py` transaction | `python3 Tools/update_queue.py . --id B1 --transition open --gate-receipt RECEIPT --expected-state-revision 0 --expected-sha256 sha256:... --actor-role integrator --apply` | | `register_amendment.py` | Sole registration writer 1.4.0 of executable operational Amendment rows for same-scope Queue replans, scope replans, batch cancellation, narrow gap-routing reconciliation, and the bounded legacy `property_state` migration. It derives the closed impact/change-class set and chooses explicit-user or matching contract-delegated authority; unknown or nondelegable classes fail closed. It accepts only the current state schema, defaults to dry-run; `--decision-mode auto|contract-delegated|explicit-user` makes the authority source explicit, requires an integrator plus exact Coverage/Queue/Progress SHA compare-and-swap, and rechecks repository-contained proposals/plans under the shared lock. It publishes the append-only receipt first, then one approved pending Progress row that names it; an unreferenced receipt is inert, so interruption cannot leave Progress pointing at absent evidence. A pending receipt is current authorization and must bind the live Progress bytes; a verified execution must bridge its three before-SHAs and time to registration, after which the registration is historical evidence only. At most one operational Amendment may be pending. `--withdraw --reason "..."` retires a pending registration whose execution can no longer validate (K13/06): it publishes an append-only withdrawal receipt naming the registration receipt and sets the row's status to `withdrawn` with write-back still false; the bound plan/proposal bytes stay verified immutable evidence and the amendment ID is never reused | `python3 Tools/register_amendment.py . --operation scope-replan --plan .cambium/deltas/amendments/A1.yaml --date YYYY-MM-DD --summary "Approved scope change" --approval-reference APPROVAL --expected-coverage-sha256 sha256:... --expected-progress-sha256 sha256:... --expected-queue-sha256 sha256:... --actor-role integrator --apply` | | `apply_amendment.py` | Cross-Ledger writer 1.4.0 consumes one registered approved scope/disposition change as a guarded Coverage/Queue/Progress transaction. The plan and registration receipt bind exact before revisions and all three SHAs to a complete Coverage proposal; `scope-replan` recompiles current Queue structure, `cancel-batch` retires one queued/open leaf, and `gap-routing-reconciliation` closes or reroutes existing gaps without creating findings; `property-state-migration` moves legacy page values into explicit Coverage observations while removing their unauthoritative page copies; every operation preserves terminal history. The writer re-derives the registered authority impact under lock. A durable prepare receipt plus lock-owner fingerprints make an interrupted multi-file write diagnosable; commit/abort receipts record the consumed registration and outcome. It does not write non-scope Task Contract changes; direct post-materialization edits fail closed and currently require a preserved successor task | `python3 Tools/apply_amendment.py . --plan .cambium/deltas/amendments/A1.yaml --expected-coverage-sha256 sha256:... --expected-progress-sha256 sha256:... --expected-queue-sha256 sha256:... --actor-role integrator --apply` | -| `adopt_standards.py` | Sole active-task Standards/Profile adoption writer 1.6.0 (K12/10 semantics; K13/15 transaction). Its closed YAML plan binds approved K00/03 bytes and upstream identity, deterministic after Kernel/Profile snapshots, Task/Contract identity, Queue revisions, three state SHAs, changed semantic predicates, dimension/boundary-specific invalidated evidence, the capability-registry projection from leaves to owner Gates, the complete derived after-load contract, and the root-owned profile-load-input fingerprint. The candidate `selected_profile_manifest_after` must pass full `profile-load` before any state write. Admission captures receipt-free snapshot/contract/input evidence; apply reruns and compares it under the writer lock before state writes, after state writes, and immediately before and after final receipt publication. Candidate evaluation never enters the current Queue receipt catalog. Drift before a durable commit restores the three before images and records abort; drift after commit evidence additionally retains the recovery lock. A `profile-load` invalidation boundary targets exactly that after-image manifest and requires the `profile-load` Gate; admission itself is not batch-scoped and is omitted from the batch rerun union, while any downstream Gates named by the same boundary keep their declared batch/Terminal reachability obligations. The Read Set closure is not a hand-picked sample: selected Read Sets are transitively closed, profile supplemental routes remain inside the selected Profile and declared route namespace, and ordinary boundary targets are all loaded modules. Dry-run is default; apply accepts only `active`/`paused`, rejects incompatible Work Specs, affected `merge-ready` batches, or affected `open` batches without `revalidation-required`, and changes no lifecycle/hold itself. It requires all three canonical state objects to satisfy the current schema, synchronizes identity/load set, advances Queue/Progress `queue_revision` once, records append-only adoption history, and consumes immediate Queue consistency before commit. Only `required-queue-consistency` is an immediate raw claim; native review, close, and completion owners remain required by their ordinary transitions, and raw leaf receipts cannot discharge them early. Sealed pre-1.3 history may omit the typed-contract fingerprint, sealed pre-1.4 history may omit the root-input fingerprint, and sealed pre-1.5 history may omit the upstream identity pair; historical receipts are not rewritten and remain catalogued, but only compatible producer protocols may satisfy the live execution chain. Prepare/commit/abort plus the lock recover partial writes; no Markdown adoption report is produced | `python3 Tools/adopt_standards.py . --plan .cambium/deltas/standards-adoptions/SA-001.yaml --apply --actor-role integrator` | +| `adopt_standards.py` | Sole active-task Standards/Profile adoption writer 1.7.0 (K12/10; K13/15). Its schema-2 plan binds unchanged K00/03 rule bytes, the exact `.cambium/governance/standards_state.yaml` before-image, next effective date, upstream identity, deterministic Kernel/Profile after snapshots, Task/Contract identity, four state SHAs, changed predicates, invalidated evidence, owner-Gate projection, and the complete derived read-set closure. Under one writer lock it advances the canonical adopter state plus Coverage, Queue, and Progress, appends receipt history, and consumes immediate Queue consistency. Failure restores all four before-images; sealed pre-1.7 history remains on its recorded schema and is never reinterpreted as current authorization | `python3 Tools/adopt_standards.py . --plan .cambium/deltas/standards-adoptions/SA-001.yaml --apply --actor-role integrator` | | `render_queue.py` | Deterministically render the optional human view at `.cambium/reports/required_queue.md`, including each Queue item's Work Spec path/SHA binding; validates canonical state first and never reads the Markdown back as input | `python3 Tools/render_queue.py .` | | `apply_delta.py` | Delta writer 1.6.0 deterministically applies one worker Coverage delta during serial merge. Every mode rejects Queue/compiler-owned control fields. `--preflight` validates the prospective routed-gap after-image while the batch is still open and writes nothing. Canonical `--root` mode binds the exact managed paths and merge-ready manifest, requires integrator role plus current Coverage/Queue SHAs, uses the shared writer lock, revalidates the result, rolls back ordinary failures, and publishes a bound receipt into a new file rather than appending to a shared JSONL -- omit `--receipts` and the run names `.cambium/receipts/.jsonl` itself; an existing `--receipts` path is refused. Gap obligations and their settlement fingerprints are bound into current receipts. A semantic page change advances `last_content_modified`, tombstones review authority bound to the prior content, removes stale Profile-Gate owner/page copies, and commits Coverage plus affected page projections as one guarded transaction. `next_batch_updates` remains a suggestion for the integrator. Detached two-path mode remains for non-runtime ledgers and is not a canonical-state write | `python3 Tools/apply_delta.py .cambium/state/coverage_ledger.yaml .cambium/deltas/B1.yaml --root . --expected-coverage-sha256 sha256:... --expected-queue-sha256 sha256:... --actor-role integrator --apply` | -| `compose_vocab.py` | Persistent vocabulary compiler 1.7.0: composes `vocab.yaml` from the kernel base and the profile selected in K00/03 active state. The selected manifest declares `profile_id` and its one `Vocabulary Extensions` binding; `volatility_defaults` registers each domain once; the resolved extensions path supplies base-field extension ownership; profile-only controlled fields are added to the frontmatter list automatically. `--extensions` may repeat the bound active path but cannot select another profile; the output header is provenance only. `--check` requires both parsed values and deterministic provenance/rendering to match | `python3 Tools/compose_vocab.py --check` | +| `compose_vocab.py` | Persistent vocabulary compiler 1.7.0: composes `vocab.yaml` from the kernel base and the profile selected in `.cambium/governance/standards_state.yaml`. The selected manifest declares `profile_id` and its one `Vocabulary Extensions` binding; `volatility_defaults` registers each domain once; the resolved extensions path supplies base-field extension ownership; profile-only controlled fields are added to the frontmatter list automatically. `--extensions` may repeat the bound active path but cannot select another profile; the output header is provenance only. `--check` requires both parsed values and deterministic provenance/rendering to match | `python3 Tools/compose_vocab.py --check` | | `scaffold_profile.py` | Safe candidate-profile scaffolder 1.0.0: copies `profiles/_template` to `profiles/` using ONLY the exact whitelist in `profiles/template-files.yaml` (never a directory walk, so junk in the template is never copied; a missing or symlinked whitelisted file fails closed), then performs only the mechanical derivations that are pure functions of the profile id — the manifest `profile_id`, the registered-scan verifier command's own `--config` path, and both Audit Dimension predicate-owner paths with their `#heading` fragments (the interview's `self_path_rewrites`). Every rewrite is anchored to exact template text and fails closed on template drift; every semantic `TODO(profile)` answer is left in place, so the fresh candidate is EXPECTED to still fail `check_profile.py` until the interview is complete. Dry-run by default; `--apply` stages into a dot-prefixed directory inside `profiles/` and publishes with one rename, removing the staging tree on any failure. Refuses an existing destination in any form (directory — even empty — file, or symlink), never merges or overwrites, touches neither `kernel/` (including K00/03) nor `.cambium/`, writes no receipt, and never selects or adopts the candidate — selection remains R09 adoption | `python3 Tools/scaffold_profile.py . --profile-id my-profile --apply` | -| `profile_onboarding_status.py` | Read-only onboarding status projector 1.0.0: derives — and never stores — the adoption/onboarding state of one root and exactly one machine-readable `next_action` token (`not-a-cambium-root`, `resume-existing-task`, `repair-control-state`, `confirm-profile-identity`, `complete-profile-interview`, `authorize-r09`, `found-empty-corpus`, `prepare-task-plan`, `onboarding-complete`), with existing-runtime recovery always winning over scaffolding and adoption. It reports whether the root is an adopting root, the K00/03 placeholder state (pre-adoption / adopted with the four values / inconsistent naming the fields), the selected manifest, the selected or targeted profile's Corpus Planning `applicability.state`, every candidate profile with its sentinel count plus a full in-process `profile-load` evaluation of the targeted candidate split into mechanical vs semantic-unresolved finding counts, the corpus page count outside the distribution/control trees, and `.cambium/` presence. It writes nothing, creates no receipts, owns no ledger, and decides nothing — every value is derived from bytes owned elsewhere, and each state's next step stays with its canonical owner tool | `python3 Tools/profile_onboarding_status.py . --json` | -| `apply_profile_adoption.py` | Sole no-runtime R09 Profile-adoption transaction writer 1.0.0: the sibling of `adopt_standards.py` for the two R09 branches that exist BEFORE any `.cambium/` runtime does — initial adoption (all four K00/03 Standards Control placeholders uninstantiated) and a pre-runtime profile revision (all four instantiated and matching the plan's `before` cells). Dry-run first; its closed restricted-YAML plan (`schemas/profile_adoption_plan.template.yaml`) binds the exact current K00/03 bytes plus the candidate's `profile-load` snapshot, typed-contract, and root-input fingerprints, and apply re-verifies every binding through the canonical `check_profile` producer — drift, a failing candidate, a partial K00/03 instantiation, or a branch/state mismatch refuses with zero writes. The transaction stages backups under `.r09-adoption-/`, writes only the four adoption cells, one Change Summary row, and the mechanical K00/16 re-measure, then drives `compose_vocab`, `compose_page_contract`, `stamp_cards --set-version --acknowledge-compiled`, and `stamp_cards --check`. That closed after-image is the only automatic semantic acknowledgement; an ordinary Standards edit still requires R09 Card regeneration/review. Any failure restores every touched byte and marks the journal aborted. On success it appends the exact `profile-load` pass receipt plus its own commit receipt beside the plan or at `--receipts` — never `.cambium/receipts/`; a root carrying `.cambium/` is refused toward `adopt_standards.py`. The candidate Profile directory is read-only | `python3 Tools/apply_profile_adoption.py . --plan adoption-plans/PA-001.yaml --apply` | +| `profile_onboarding_status.py` | Read-only onboarding status projector 1.1.0: derives one machine-readable `next_action` from the presence/validity of `.cambium/governance/standards_state.yaml`, candidate Profile admission, corpus state, and `.cambium/state/` task-runtime presence. A governance-only `.cambium/` is pre-runtime state, not a task to resume. It writes nothing and owns no ledger | `python3 Tools/profile_onboarding_status.py . --json` | +| `apply_profile_adoption.py` | Sole no-task-runtime R09 Profile-adoption writer 2.0.0. Initial adoption creates `.cambium/governance/standards_state.yaml`; a pre-task Profile revision advances it. The plan binds unchanged K00/03 rule bytes, the absent/current state, upstream identity, and exact `profile-load` evidence. The transaction appends `.cambium/receipts/standards-adoptions.jsonl`, regenerates vocabulary/page-contract/Cards, and rolls back every touched byte on failure. It never adds history to Kernel Markdown or Cards; an existing `.cambium/state/` routes to `adopt_standards.py` | `python3 Tools/apply_profile_adoption.py . --plan adoption-plans/PA-001.yaml --apply` | +| `migrate_standards_state.py` | One-time compatibility bridge 1.0.0 for an existing task runtime whose current Standards/Profile identity is still repeated only across Coverage, Queue, and Progress. It requires those three values to agree and a committed adoption receipt to account for the live version, then materializes the canonical state without rewriting history or K00/03. Dry-run by default | `python3 Tools/migrate_standards_state.py . --apply` | | `check_profile.py` | Sole `profile-load` Gate producer 2.0.0. It derives the slot list from `profiles/README.md`; verifies identity/directory agreement, slot bindings, sparse execution overrides, `Configured`/inactive table consistency, invalid UTF-8, sentinels, reserved IDs, and the Structure Registry's closed shape. It then calls `profile_contract.py` once to authorize the machine-active self-path closure from the selected manifest through the Audit Dimension Registry extension dimensions and Judgment Item owner headings and the Registered Scan Registry verifier, optional config, predicate, semantics, and Judgment Item references. Extension Gate rows compile as typed producer, receipt-schema, consumer, owner-field, transition, enum, and pass-authority bindings and must resolve to the installed generic Profile-enum writer capability. Every Profile-owned path must remain lexically and physically inside the selected Profile, exact heading references resolve once, and symlink/hardlink aliases fail closed. A pass summary uses check `profile-check-summary`, Gate ID `profile-load`, dimension `guidance_and_contract`, and binds `selected_profile_manifest`, the complete Profile-tree `profile_snapshot_sha256`, `profile_contract_fingerprint`, and the canonical root-input `profile_load_inputs_sha256`. Receipt output is refused inside the Profile itself so validation cannot mutate the package whose snapshot it binds. The checker parses one immutable Profile-tree snapshot and rechecks both that tree and the canonical inputs before authorization. It checks authority and structure, never answer quality, and is not run against `_template` itself. `--json` writes one deterministic structured-diagnostics object to stdout (tool, root, result, findings), each finding carrying a category from the closed classification map: `mechanical` (an assisting agent can fix it directly and rerun — path resolution, identity/directory agreement, table and manifest shape, self-reference containment, declaration word shape) vs `semantic-unresolved` (an operator answer is missing or unconfirmed — `unfilled-placeholder` sentinels and other open decisions); human output, receipts, and exit codes are unchanged | `python3 Tools/check_profile.py profiles/ --root . --receipts Tools/receipts/profile.jsonl` | | `check_structure.py` | Sole `structure-registry` gate 1.1.0 (K01/05, K01/06): resolves the selected profile's Structure Registry against the vault — unit and support-layer roots, canonical entries and `expected_type` frontmatter, embedded headings, per-mode role declarations, Profile Scope layer membership, module-inside-parent containment, flat/grouped layout consistency with declared class-to-directory agreement, Corpus Planning Global Map entry bindings, and Coverage Ledger `structural_unit` references; `--profile` overrides the active-state selection; fails closed on an unresolved profile, unbound or unreadable registry, or a configured registry with no units. It proves structure declarations, never content quality or class-assignment semantics | `python3 Tools/check_structure.py . --profile profiles/ --receipts Tools/receipts/structure.jsonl` | | `compose_page_contract.py` | Deterministic page-contract compiler 1.2.0 (K08/06): composes the kernel `applicability-base.yaml` and `relationship-base.yaml` with the selected profile's `Metadata Contract` and `Vocabulary Extensions` and the K07 `sources-role-base.yaml` into `Tools/page_contract.yaml`, including the profile-bound section-role display titles; a profile difference may only tighten a kernel mode, extensions must not collide with kernel fields, and `--check` verifies the artifact is byte-current; the K08/09 boundary projection display labels compose as kernel defaults overlaid by the profile's `boundary_projection.labels`; `--profile` names a profile for a validation run without selecting it | `python3 Tools/compose_page_contract.py --profile profiles/` | @@ -110,7 +111,7 @@ returned Addendum is bound to the parent Bundle and refuses source drift. | `render_structure_projection.py` | Registered generator 1.1.0 for Structure Registry `derived` coverage roles (K01/05): computes each unit's projection from the Capability Matrix and Coverage Ledger and owns only the marker-delimited block inside the registered section — curated prose around it is conserved; `--check` reports stale blocks, `--apply` writes them atomically, and roles without a page target render on demand; it copies no Queue lifecycle and never writes back into planning artifacts | `python3 Tools/render_structure_projection.py . --profile profiles/ --check` | | `check_residual_content.py` | Generic, Profile-blind K12/09 item 6 residual-content scanner: it receives `--scan-id` and `--config` explicitly and neither discovers the selected Profile nor parses its registry. The selected profile owns every accepted/excluded content root and every literal frontmatter/heading matcher in that config; only VCS metadata directories named `.git`, `.hg`, or `.svn` are always outside traversal. The tool owns safe traversal, fence-aware matching, a hard ≤55-second evidence-production budget, zero-file, missing-accepted-root, and inert-matcher failure, receipts, and `0/1/2` exit semantics; missing excluded roots are allowed. Its `mandated_headings` control inputs run through the production `classify` path. `--positive-controls-only` loads the same config and executes those controls without scanning repository content; batch close runs that explicit mode before the production scan and binds the two final summaries. When a production run finds no candidate, the accepted roots are additionally re-read as the profile's own known-residual sample and the configuration must recognise at least one Markdown file there, otherwise the run fails with `residual-content-inert-matcher`; the summary then names the witness. The caller must still satisfy the kernel's ≤60-second whole-command contract. `--scan-id` binds every receipt to the stable registry ID; receipts from a successfully loaded config record its SHA-256 so configuration changes invalidate old evidence. Findings are candidates only. Tool contract owner: K12/09 item 6; scan-definition owner: selected profile `Registered Scan Registry` | `python3 Tools/check_residual_content.py . --scan-id --config profiles//scan-configs/.yaml --time-limit 55 --receipts Tools/receipts/residual.jsonl` | | `profile_contract.py` | Shared library and sole typed Profile-contract linker, not a command. It parses the exact machine-active Audit Dimension and Registered Scan sections into a source-addressable intermediate representation; resolves Profile-owned files and heading fragments under lexical and real-path containment; rejects ambiguous, missing, symlinked, or multiply linked dependencies; and emits a canonical dependency-graph fingerprint only when the whole contract is authorized. `check_profile.py` and every runtime consumer reached through `profile_admission.py` consume this same result instead of independently reinterpreting those Markdown cells. It can compile the one required scan command for a caller, but it neither executes a verifier nor scans repository content | imported by the scripts above; no command-line entry point | -| `profile_admission.py` | Shared consumer adapter, not a command. It selects the explicit or K00/03-approved Profile, performs exactly one complete `profile-load`, exposes the authorized immutable Profile snapshot and typed slot paths/text, and rechecks Profile-tree, root-input, and active-selection currency before a consumer emits a pass result or writes an artifact. Profile-dependent tools use this view instead of reopening the manifest or slot files under a later revision | imported by the Profile-dependent scripts above; no command-line entry point | +| `profile_admission.py` | Shared consumer adapter, not a command. It selects the explicit or canonical-state-approved Profile, performs exactly one complete `profile-load`, exposes the authorized immutable Profile snapshot and typed slot paths/text, and rechecks Profile-tree, root-input, and active-selection currency before a consumer emits a pass result or writes an artifact. Profile-dependent tools use this view instead of reopening the manifest or slot files under a later revision | imported by the Profile-dependent scripts above; no command-line entry point | | `metadata_execution_contract.py` | Closed metadata-execution authority compiler and loader 1.0.0. It compiles Kernel field/transition rules with the installed operation capability registry, requires exact rule/operation coverage, and requires every writer/consumer/producer/receipt-schema capability to name canonical `Tools/*.py` implementation paths. Stable no-follow hashes of the complete implementation set enter `compiled/metadata-execution-contract.json`; the loader refuses source, implementation-byte, or artifact drift. Its pure path API lets `profile-load` freeze those files inside the same canonical root-input view | `python3 Tools/metadata_execution_contract.py --root . --check` | | `record_gate_attestation.py` | Manual Extension Gate evidence producer 1.0.0. It resolves one exact Gate only from the current snapshot-bound typed Profile contract, requires the Gate's registered pass-authority role and completion enum, and emits a `manual-gate-attestation-v1` receipt binding the page's projection-neutral semantic fingerprint, exact page bytes, selected Profile manifest/tree/typed-contract/root-input fingerprints, active K00 revision, and metadata execution contract. It writes no state or page; dry-run is default | `python3 Tools/record_gate_attestation.py . --gate-id P:: --page --value --actor-role --statement "Bounded judgment" --apply` | | `record_batch_judgment.py` | Sole per-target Batch Review judgment scribe 1.0.0 (K12/14): answers one frozen Batch Review Requirement record for one open batch — validates the target against the activation-frozen expansion, the reviewer against the Profile's registered pass-authority role, and binds the judgment to the batch's current activation receipt, the target's semantic content fingerprint, and the authorized Profile contract fingerprint, so reopening the batch, editing the page, or revising the Profile invalidates the evidence. Rebuilds every binding under the runtime write lock immediately before publication and fails closed on any drift. Changes no page, Ledger, or Queue state; `update_queue.py` consumes the exact record set at `open -> merge-ready` through the batch-review wrapper. | `python3 Tools/record_batch_judgment.py . --batch --judgment-item --target --reviewer-role --statement "..." --apply` | @@ -119,7 +120,7 @@ returned Addendum is bound to the parent Bundle and refuses source drift. | `metadata_gate_runtime.py` | Shared closed adapter for typed Extension Gate execution. It consumes the one authorized Profile view, resolves one exact Gate, verifies installed producer/schema/consumer capabilities, derives a single evidence-backed enum projection rule, constructs the common receipt binding, and validates current-catalog evidence. It performs no writes and accepts no policy callback | imported by the three Extension Gate CLIs above; no command-line entry point | | `metadata_property_state.py` | Pure owner-state transition library for semantic-content, review, and typed Gate events. It deep-copies Coverage, emits closed `value`/`evidence_receipt`/`content_fingerprint` records, derives projection plans from proposed owner state, and performs no lock, file write, or authority judgment | imported by Integrator writers; no command-line entry point | | `card_activation.py` | Pure Card-first delivery compiler. It resolves the frozen Task Contract against the Card Index, snapshots exact Card/Read Set/source bytes without following links, requires R01 and acknowledged semantic Card hashes, delivers an explicitly frozen canonical Card Index as startup navigation without treating it as an Rxx route, builds the content-addressed activation Bundle and declared Read-back Addenda, and labels host-bound versus degraded delivery without writing state | imported by Queue admission/transition tools; no command-line entry point | -| `stamp_cards.py` | Kernel route and Runtime Card verification (K00/03 Write-back Checklist): checks the shared `kernel-runtime-routes` identity, exact R01-R13 Read Set/Card pairs, filenames, source boundaries, and the exact partition of every paired Read Set boundary leaf into Card `source_files` or `readback_sources`. `source_hash` tracks current input bytes; ordinary stamping updates it but leaves the Card stale until semantic regeneration/review is explicitly recorded with `--acknowledge-compiled`, which advances `compiled_source_hash`. `--check` requires both hashes to equal the current digest, every `compiled_from` to equal the active K00/03 version, command spans to supply required arguments, Card/Read Set H2 skeletons to match K00/14, every Kernel leaf to be reachable and within its K00/03/K00/16 budget disposition, and every K00/12 Gate row to agree with its producer. Missing, empty, incomplete, overlapping, or malformed layers fail closed; `--check` is read-only; `--set-version` must equal the active version and stamps every Card including the Index | `python3 Tools/stamp_cards.py . --check` | +| `stamp_cards.py` | Kernel route and Runtime Card verification (K00/03 Write-back Checklist): checks the shared `kernel-runtime-routes` identity, exact R01-R13 Read Set/Card pairs, filenames, source boundaries, and the exact partition of every paired Read Set boundary leaf into Card `source_files` or `readback_sources`. `source_hash` tracks current input bytes; ordinary stamping updates it but leaves the Card stale until semantic regeneration/review is explicitly recorded with `--acknowledge-compiled`, which advances `compiled_source_hash`. `--check` requires both hashes to equal the current digest, every `compiled_from` to equal the canonical adopter version (or the explicit public-distribution template), command spans to supply required arguments, Card/Read Set H2 skeletons to match K00/14, every Kernel leaf to be reachable and within its K00/03/K00/16 budget disposition, and every K00/12 Gate row to agree with its producer. Missing, empty, incomplete, overlapping, or malformed layers fail closed; `--check` is read-only; `--set-version` must equal the active version and stamps every Card including the Index | `python3 Tools/stamp_cards.py . --check` | | `compile_cli_contract.py` | Persistent CLI invocation-contract compiler 1.0.0: derives `Tools/compiled/cli-contract.yaml` from the `argparse` declaration each `Tools/*.py` CLI builds for itself, so the calling contract has one source rather than a prose restatement that can drift. Each tool is imported with `parse_args` patched to raise the instant its parser is complete, so no tool behaviour runs and no tool signature changes; per argument it records `option_strings` (empty for a positional), `dest`, `required`, the evaluated `default`, `choices`, `nargs`, `action`, `type` name and `help`, plus each `add_mutually_exclusive_group` and the receipt extension fields that tool's own source writes onto a `make_*receipt(...)` result. The artifact is machine-generated and must not be hand-edited; it registers no K00/12 Gate ID because it depends on no selected profile and `run_gates` could therefore never sweep it, which is why `make check` runs it directly. `--check` exits 2 when the artifact is stale or hand-edited, 1 only when the evidence itself is unreliable | `python3 Tools/compile_cli_contract.py . --check` | | `render_interface_projection.py` | Agent-facing form projection 1.0.0: projects `Tools/compiled/cli-contract.yaml` into the interface shapes an agent runtime actually reads, so a protocol-shaped tool list is a derived view of the one compiled contract rather than a second declaration of it. `FORMS` is a registry, not a special case: each entry names its own output and builder, `--form` selects one, and an argument-free run writes or checks every registered form. The `mcp` form writes `Tools/compiled/mcp-tools.json` -- per tool a `name`, the argparse `description`, and an `inputSchema` whose properties are keyed by `dest` (an undeclared `type` projects as `string`, which is what argv carries; `choices` becomes `enum`, `required` becomes the `required` array, an empty `option_strings` is the positional), plus `stdio` and `streamable-http` and no other transport branch. Every projected field is bound in the tool's own `FIELD_SOURCES` table to the upstream field or rule it comes from, and a field no source covers fails the run; `--sources` prints that table. The artifact carries the sha256 of the contract bytes it was projected from and that contract's own manifest hash, so one upstream change invalidates every form at once and no two forms are ever compared with each other. It is machine-generated and must not be hand-edited, and it registers no K00/12 Gate ID for the same reason its upstream does not. `--check` exits 2 when an artifact is stale or hand-edited, and 1 when the evidence is unreliable -- including when the compiled contract changes underneath the run | `python3 Tools/render_interface_projection.py . --check` | | `render_host_configs.py` | MCP server registration and corpus binding 1.0.0: renders the one server definition body this tool declares (`command`, `args`, `cwd`, `env`, and the dsh-only connection-resilience superset) into the configuration file each supported host actually reads. Registration -- where the server is and how it starts -- is once per machine; binding -- which corpus this run governs, carried as `CAMBIUM_WORKSPACE_ROOT` -- is once per corpus. `HOSTS` is a registry with one builder and one output file per host: Claude Code (`/.mcp.json`), Kimi Code (`/.kimi-code/mcp.json`), Codex (`/.codex/config.toml`, loaded only for a trusted project), dsh's per-corpus `.env` (binding only) and dsh's `$DSH_HOME/profiles//` rows (registration only). The five products are templates rendered under `Tools/compiled/host-configs/` for an adopter's corpus repository; this distribution registers no MCP server with itself and writes none of these files at its own root. Every product carries `CAMBIUM_INTERFACE_SOURCE_HASH`, the sha256 of the `compiled/mcp-tools.json` bytes it was rendered against, so one upstream change makes all five stale at once. Every rendered field is bound in the tool's own `FIELD_SOURCES` table -- the server name included, because the name is spelled into those paths -- and a field no source covers fails the run; `--sources` prints that table. `--distribution-root` and `--workspace-root` substitute the two placeholders for an onboarding flow writing a bound copy. It is machine-generated and must not be hand-edited, and it registers no K00/12 Gate ID for the same reason its upstream does not. `--check` exits 2 when a product is stale or hand-edited, and 1 when the evidence is unreliable | `python3 Tools/render_host_configs.py . --check` | @@ -151,6 +152,7 @@ uninstantiated distribution: ```text .cambium/ + governance/standards_state.yaml state/coverage_ledger.yaml state/required_queue.yaml state/progress_ledger.yaml @@ -158,13 +160,14 @@ uninstantiated distribution: deltas/.yaml deltas/standards-adoptions/.yaml receipts/*.jsonl + receipts/standards-adoptions.jsonl reports/required_queue.md tmp/ ``` The normal control sequence is: -1. At the start of every task, test whether `.cambium/` exists. If it does, run +1. At the start of every task, test whether `.cambium/state/` exists. If it does, run `check_queue.py . --resume-status` before any state/content write and resume only by following its `next_action` after reconciling the recorded task, checkpoint binding, task receipt, lifecycle groups, pending controls/deltas, @@ -172,10 +175,11 @@ The normal control sequence is: Never initialize over it. A new task requires the old task to be explicitly completed/cancelled and later archived or rolled over; current tools do not automate rollover. -2. Only when `.cambium/` is absent, and only for a selected persistent, +2. Only when `.cambium/state/` is absent, and only for a selected persistent, resumable, or multi-batch route, run `init_state.py --apply` after profile adoption, a successful `profile-load` of that candidate Profile, and task - definition. Declare exactly one + definition. Preserve any governance state and adoption history already in + `.cambium/`. Declare exactly one `--completion-semantics build|maintenance`; the tool has no default. Bounded work does not create an empty runtime. It creates empty state, so `check_queue.py` returns 2 until Required work is @@ -215,8 +219,8 @@ The normal control sequence is: It then publishes all three canonical files under the shared lock and marks the Amendment verified. Closed/cancelled history is preserved exactly and in-flight structure cannot change. -5. Before activation, resume, or completion entry, compare the active K00/03 - Standards/Profile identity with the Task Contract and all three state +5. Before activation, resume, or completion entry, compare the canonical + adopter Standards/Profile identity with the Task Contract and all three task state objects. On mismatch, consume the R09-authorized restricted-YAML plan under `.cambium/deltas/standards-adoptions/` and dry-run `adopt_standards.py`. A stale `completion-candidate` first transitions @@ -364,8 +368,9 @@ must start with its `route_id`. A structural mismatch exits 1; a structurally valid but stale Card layer exits 2 in `--check` mode. `source_hash` is the observed digest and is advanced by ordinary stamping; `compiled_source_hash` is advanced only by `--acknowledge-compiled` after semantic regeneration or -review. Only exact structure, equal current hashes, and agreement with K00/03 -active `standards_version` exits 0. +review. Only exact structure, equal current hashes, and agreement with the +canonical adopter `standards_version` (or the explicit public-distribution +template) exits 0. It also compares each layer command against the tool that command names. A code span whose first token is `python3` is the copy-and-run form an agent types @@ -460,15 +465,16 @@ not skip the canonical rule text, which remains under the rest of `kernel/`. config, while the typed registry also permits a custom verifier with no `--config` argument. - **Persistent task / multi-batch control** = `check_queue.py --resume-status` - at every restart or new-Agent entry when `.cambium/` exists, then the Queue + at every restart or new-Agent entry when `.cambium/state/` exists, then the Queue gate at admission, activation, batch close, and the selected build or maintenance completion path. `init_state.py`, `compile_queue.py`, and `update_queue.py` write only through their explicit dry-run/apply boundary; a bounded single-note task does not create an empty Queue merely to satisfy this route. - **Active-task Standards adoption** = K12/10 validates one restricted-YAML - changed-predicate plan; `adopt_standards.py` is the only writer of the three - synchronized runtime identities and Progress Contract/load set. R09 creates + changed-predicate plan; `adopt_standards.py` is the only writer of the + canonical adopter state, three synchronized task identities, and Progress + Contract/load set. R09 creates the governance input and confirms Work Spec compatibility, while R07 applies or recovers the transaction. The selected Profile after-image must pass `profile-load` before the transaction can write. Its admission boundary is @@ -671,9 +677,10 @@ evidence silently. here carries the block-by-block relocation table - `standards_adoption_plan.template.yaml` -- the closed restricted-YAML changed-predicate plan consumed by `adopt_standards.py` (semantics owner: - K12/10; transaction owner: K13/15); it binds approved K00/03 bytes, the - deterministic after Kernel/Profile snapshots, Task/Contract identity, Queue - revisions, all three state SHA-256 values, the changed predicates, the + K12/10; transaction owner: K13/15); it binds approved K00/03 rule bytes, the + exact canonical adopter-state before-image, deterministic after + Kernel/Profile snapshots, Task/Contract identity, Queue revisions, all four + state SHA-256 values, the changed predicates, the dimension- and boundary-specific invalidated evidence, and the immediate versus deferred gate split. The selected Profile after-image must pass `profile-load`; a `profile-load` boundary targets exactly that manifest and @@ -684,10 +691,10 @@ evidence silently. consumed by `apply_profile_adoption.py`, the no-runtime sibling of the active-task adoption plan above (rule owner: K00/03; R09 both branches). It declares the branch (`initial-adoption` or `profile-revision`), the - four K00/03 after values, the Change Summary row content, an empty + canonical state after values, append-only receipt detail, an empty `changed_predicates` list (a nonempty list belongs to `adopt_standards.py`), and the compare-and-swap fingerprints: exact - current K00/03 bytes plus the candidate Profile's `profile-load` tree + current K00/03 rule bytes plus the absent/current state and candidate Profile's `profile-load` tree snapshot, typed contract fingerprint, and root-input fingerprint. Its `TODO(profile-adoption)` sentinels must all be replaced - `task_plan.template.yaml` -- the closed restricted-YAML initial task plan @@ -880,10 +887,12 @@ carry no Gate ID, because they depend on no selected profile. `vocab.yaml` is a **generated artifact**, produced by `compose_vocab.py` from `kernel/K08 Metadata and Status/vocabulary-base.yaml` plus the -`vocabulary-extensions.yaml` of the profile selected by K00/03 active state. +`vocabulary-extensions.yaml` of the Profile selected by the canonical adopter +Standards state. The artifact header records compilation provenance and the sha256 of both -inputs; it never selects the active profile. The tool carries no default -profile of its own. Every run reads K00/03; an argument-free run derives the +inputs; it never selects the active Profile. The tool carries no default +Profile of its own. Every run reads the adopter Standards state; an +argument-free run derives the extensions path from the selected manifest, and an explicit `--extensions` must name that same bound file. @@ -896,7 +905,8 @@ second source. **This repository ships no composed `vocab.yaml`.** Committing one would write instance-specific compiled values and provenance into the generic release, -even though its K00/03 active state intentionally selects no profile. What is +because the public distribution intentionally has no adopter Standards state +and selects no Profile. What is published here is a kernel base and an interface, not an adopter artifact. Until a profile is selected and composed, `compose_vocab.py --check` exits 1 and reports the selectable direct-child @@ -911,7 +921,8 @@ Compose the artifact once, against your own profile: python3 Tools/compose_vocab.py ``` -This command succeeds only after K00/03 selects that profile. After that, +This command succeeds only after initial adoption selects that Profile in the +canonical state. After that, `compose_vocab.py` with no arguments recomposes from the active state, and `compose_vocab.py --check` verifies that the artifact still matches the currently selected profile rather than merely agreeing with its old header. diff --git a/Tools/adopt_standards.py b/Tools/adopt_standards.py index ff5140c..58b9e16 100644 --- a/Tools/adopt_standards.py +++ b/Tools/adopt_standards.py @@ -5,7 +5,7 @@ default is a dry run. ``--apply --actor-role integrator`` is the only write path; it holds the shared runtime writer lock, appends prepare/commit/abort evidence, preserves unrelated state exactly, and rolls ordinary failures back -to the three frozen before images. +to the four frozen before images (the three task Ledgers plus adopter state). """ import contextlib @@ -17,9 +17,10 @@ sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) import check_queue import kblib +import standards_state TOOL = "adopt_standards" -TOOL_VERSION = "1.6.0" +TOOL_VERSION = "1.7.0" GATE_ID = "standards-adoption" # The `Check` cell K00/12 registers for this Gate; every receipt this # tool offers as gate evidence carries it verbatim. @@ -182,6 +183,9 @@ def _state_paths(root, current): "progress": kblib.managed_repository_path( root, check_queue.PROGRESS_PATH, ".cambium/state", suffixes=(".yaml",), must_exist=True), + "standards": kblib.managed_repository_path( + root, standards_state.STATE_PATH, ".cambium/governance", + suffixes=(".yaml",), must_exist=True), } @@ -217,6 +221,13 @@ def _non_adoption_projection(name, document): "contract_version", "standards_version", "selected_profile_manifest") + LOAD_FIELDS: contract.pop(field, None) + elif name == "standards": + for field in ( + "state_revision", "standards_version", "status", + "effective_date", "selected_profile_manifest", + "latest_adoption_receipt", "upstream_source_ref", + "upstream_revision_id"): + value.pop(field, None) return value @@ -226,7 +237,7 @@ def _projection_sha(name, document): def _assert_only_permitted_changes(before, after): - for name in ("coverage", "queue", "progress"): + for name in ("coverage", "queue", "progress", "standards"): if _non_adoption_projection(name, before[name]) != \ _non_adoption_projection(name, after[name]): raise ValueError( @@ -268,9 +279,11 @@ def _new_receipt(phase, result, plan, transaction_id, plan_path, plan_sha, "before_coverage_sha256": before_sha["coverage"], "before_queue_sha256": before_sha["queue"], "before_progress_sha256": before_sha["progress"], + "before_standards_state_sha256": before_sha["standards"], "after_coverage_sha256": after_sha["coverage"], "after_queue_sha256": after_sha["queue"], "after_progress_sha256": after_sha["progress"], + "after_standards_state_sha256": after_sha["standards"], "before_contract_sha256": check_queue._contract_sha256( before["progress"]), "after_contract_sha256": check_queue._contract_sha256( @@ -283,6 +296,8 @@ def _new_receipt(phase, result, plan, transaction_id, plan_path, plan_sha, "contract_version_after": plan["contract_version_after"], "standards_version_before": plan["standards_version_before"], "standards_version_after": plan["standards_version_after"], + "standards_effective_date_after": + plan["standards_effective_date_after"], "selected_profile_manifest_before": plan["selected_profile_manifest_before"], "selected_profile_manifest_after": @@ -376,10 +391,19 @@ def _prepare_result(root, plan_relative): "coverage": plan["coverage_sha256_before"], "queue": plan["required_queue_sha256_before"], "progress": plan["progress_sha256_before"], + "standards": plan["standards_state_sha256_before"], } - for name in ("coverage", "queue", "progress"): + for name in ("coverage", "queue", "progress", "standards"): if before_sha[name] != expected_sha[name]: raise ValueError("plan %s SHA does not match current bytes" % name) + try: + standards_before, standards_errors = standards_state.parse( + before_raw["standards"].decode("utf-8")) + except UnicodeDecodeError as exc: + raise ValueError("current Standards state is not UTF-8: %s" % exc) + if standards_errors: + raise ValueError("current Standards state is invalid: %s" % + "; ".join(standards_errors)) contract = progress["contract"] expected_identity = { "task_id": plan["task_id"], @@ -404,6 +428,13 @@ def _prepare_result(root, plan_relative): if actual_identity[field] != expected: raise ValueError("plan before %s=%r, current value is %r" % (field, expected, actual_identity[field])) + if (standards_before["standards_version"] != + plan["standards_version_before"] or + standards_before["selected_profile_manifest"] != + plan["selected_profile_manifest_before"]): + raise ValueError( + "current adopter Standards state differs from the plan before " + "identity") existing = progress.get("standards_adoptions") if not isinstance(existing, list): raise ValueError("Progress standards_adoptions is malformed") @@ -415,6 +446,7 @@ def _prepare_result(root, plan_relative): "coverage": copy.deepcopy(coverage), "queue": copy.deepcopy(queue), "progress": copy.deepcopy(progress), + "standards": copy.deepcopy(standards_before), } after = copy.deepcopy(before) after["coverage"]["standards_version"] = plan["standards_version_after"] @@ -448,6 +480,17 @@ def _prepare_result(root, plan_relative): GATE_CHECK, plan["adoption_id"], "pass", "Standards adoption commit", 2, identity=_plan_identity(plan)) + standards_after = standards_state.next_state( + standards_before, + standards_version=plan["standards_version_after"], + effective_date=plan["standards_effective_date_after"], + selected_profile_manifest=plan["selected_profile_manifest_after"], + latest_adoption_receipt=commit_stub["receipt_id"], + upstream_source_ref=plan["upstream_source_ref"], + upstream_revision_id=plan["upstream_revision_id"], + ) + standards_text = standards_state.canonical_text(standards_after) + after["standards"] = standards_after # The immediate consistency receipt is produced against the committed # after-image. Allocate it after the commit identity so its timestamp is # never earlier than ``record.adopted_at``; the same receipt can then @@ -470,6 +513,12 @@ def _prepare_result(root, plan_relative): "contract_version_after": plan["contract_version_after"], "standards_version_before": plan["standards_version_before"], "standards_version_after": plan["standards_version_after"], + "standards_effective_date_after": + plan["standards_effective_date_after"], + "standards_state_sha256_before": + plan["standards_state_sha256_before"], + "after_standards_state_sha256": + kblib.sha256_bytes(standards_text), "selected_profile_manifest_before": plan["selected_profile_manifest_before"], "selected_profile_manifest_after": @@ -516,6 +565,7 @@ def _prepare_result(root, plan_relative): "coverage": coverage_text, "queue": queue_text, "progress": progress_text, + "standards": standards_text, } after_sha = {name: kblib.sha256_bytes(text) for name, text in after_text.items()} @@ -560,7 +610,9 @@ def _prepare_result(root, plan_relative): check_queue.PROGRESS_PATH: (progress_text, after["progress"]), } final = check_queue.validate_runtime( - root, state_overrides=overrides, extra_receipts=[gate, commit]) + root, state_overrides=overrides, + active_standards_state_override=standards_text, + extra_receipts=[gate, commit]) if final["errors"]: raise ValueError("planned final state fails check_queue: %s" % "; ".join(final["errors"])) @@ -578,7 +630,7 @@ def _prepare_result(root, plan_relative): def _restore(paths, before_raw): failures = [] - for name in ("coverage", "queue", "progress"): + for name in ("coverage", "queue", "progress", "standards"): try: kblib.atomic_write_text( paths[name], before_raw[name].decode("utf-8"), @@ -617,6 +669,10 @@ def _lock_operation(prepared, receipt_path, abort_id): "planned_after_required_queue_sha256": prepared["after_sha"]["queue"], "before_progress_sha256": prepared["before_sha"]["progress"], "planned_after_progress_sha256": prepared["after_sha"]["progress"], + "before_standards_state_sha256": + prepared["before_sha"]["standards"], + "planned_after_standards_state_sha256": + prepared["after_sha"]["standards"], "selected_profile_manifest_after": prepared["profile_evidence"]["selected_profile_manifest"], "profile_snapshot_sha256_after": @@ -680,7 +736,7 @@ def _commit_transaction(prepared, receipt_path): receipt_path, final_receipts) commit_before = kblib.receipt_append_observation( receipt_path, [prepared["commit"]]) - for name in ("coverage", "queue", "progress"): + for name in ("coverage", "queue", "progress", "standards"): kblib.atomic_write_text( prepared["paths"][name], prepared["after_text"][name], validator=kblib.parse_yaml_subset) @@ -788,7 +844,7 @@ def _run(args): plan["adoption_id"], plan["standards_version_before"], plan["standards_version_after"], plan["queue_revision_before"], plan["queue_revision_after"])) - for name in ("coverage", "queue", "progress"): + for name in ("coverage", "queue", "progress", "standards"): print("%s_sha256=%s -> %s" % ( name, prepared["before_sha"][name], prepared["after_sha"][name])) if not args.apply: diff --git a/Tools/apply_profile_adoption.py b/Tools/apply_profile_adoption.py index 1e70728..7b3576f 100644 --- a/Tools/apply_profile_adoption.py +++ b/Tools/apply_profile_adoption.py @@ -1,51 +1,17 @@ #!/usr/bin/env python3 -"""Sole no-runtime R09 Profile-adoption transaction writer. - -`adopt_standards.py` owns the ACTIVE-TASK branch of a Standards/Profile -revision: it synchronizes the three `.cambium/` state objects and their -receipts. This tool is its sibling for the case where NO runtime exists yet: -initial adoption (all four K00/03 Standards Control placeholders -uninstantiated) and a later profile revision made before any `.cambium/` -namespace has been created. A root that carries `.cambium/` anywhere is -refused toward the active-task flow; this writer never creates, reads, or -"quietly syncs" runtime state. - -The restricted-YAML plan (`Tools/schemas/profile_adoption_plan.template.yaml`) -is the canonical machine revision record. It binds the exact current K00/03 -bytes and one passing `profile-load` evaluation of the candidate Profile -(directory snapshot, typed contract fingerprint, root-input fingerprint); the -apply re-verifies every binding and re-runs the same canonical producer, so -the tool never adopts unseen bytes and never reimplements any part of the -`profile-load` Gate. - -The transaction writes, in order: the K00/03 after-image (four Standards -Control cells plus one appended Change Summary row), the mechanical K00/16 -re-measure of K00/03's registered size (the Revision Write-back Checklist -names that register as a synchronized snapshot location, and -`stamp_cards --check` cannot exit 0 without it), then drives the existing -producers against the new K00/03 state: `compose_vocab.py`, -`compose_page_contract.py`, `stamp_cards.py --set-version ---acknowledge-compiled`, and `stamp_cards.py --check`. The explicit semantic -acknowledgement is authorized only because this transaction proves the K00/03 -after-image is limited to its four adoption cells, one Change Summary row, and -the mechanical size re-measure; any other Standards change belongs to ordinary -R09 regeneration/review. Every to-be-touched file is backed up first under a -dot-prefixed staging directory (`.r09-adoption-/`) with a journal -recording the plan SHA and step states, so an interrupted run is diagnosable -and resumable. Any failure restores the pre-transaction bytes of every -touched file, verifies the restoration, and leaves the journal marked -aborted; no partial adoption survives. Re-running with the same plan after -an interruption restores and completes; a retry with a different plan while a -journal exists is refused. - -On success the transaction appends two JSONL receipts next to the plan (or at -an explicit `--receipts` path): the exact `profile-load` pass summary receipt -the canonical `check_profile` producer emitted for the adopted candidate -(Gate ID `profile-load`, K00/12), and this tool's own commit receipt binding -tool/version, plan SHA, and every before/after fingerprint. Like -`apply_task_plan.py`, the commit receipt registers no Gate ID of its own: the -state it writes is consumed by gates that already exist. The runtime receipt -register `.cambium/receipts/` is never written -- no runtime exists. +"""Sole no-task-runtime R09 Profile-adoption transaction writer. + +The restricted-YAML plan binds unchanged K00/03 rule bytes, the absent or +current canonical adopter Standards state, upstream identity, and one exact +passing `profile-load` evaluation. Initial adoption creates +`.cambium/governance/standards_state.yaml`; a pre-task revision advances it. +Both append `.cambium/receipts/standards-adoptions.jsonl`, then regenerate +vocabulary, page-contract, Card, and interface projections. K00/03 and Cards +never store the chronological adoption register. + +Every touched byte is staged and recoverable. Any task runtime under +`.cambium/state/` redirects the caller to `adopt_standards.py`; governance and +receipt namespaces alone do not constitute a task runtime. Dry-run is the default; `--apply` performs the transaction. Exit codes follow the writer convention: 0 = success (dry-run or applied), 1 = refusal @@ -55,6 +21,7 @@ [--apply] [--json] [--receipts PATH] """ +import errno import json import os import re @@ -66,9 +33,10 @@ sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) import check_profile import kblib +import standards_state TOOL = "apply_profile_adoption" -TOOL_VERSION = "1.0.0" +TOOL_VERSION = "2.0.0" # Consumed gate identity (K00/12 Stable Gate ID Registry); this tool registers # no Gate ID of its own and `check_profile` remains the sole producer. PROFILE_LOAD_GATE_ID = check_profile.GATE_ID @@ -81,6 +49,7 @@ VOCAB_ARTIFACT = "Tools/vocab.yaml" PAGE_CONTRACT_ARTIFACT = "Tools/page_contract.yaml" RUNTIME_NAMESPACE = ".cambium" +RECEIPT_RELATIVE = ".cambium/receipts/standards-adoptions.jsonl" STAGING_PREFIX = ".r09-adoption-" JOURNAL_NAME = "journal.json" @@ -101,29 +70,10 @@ "change_summary", "changed_predicates", "adoption_requirement", "k00_03_sha256_before", "profile_snapshot_sha256_after", "profile_contract_fingerprint_after", "profile_load_inputs_sha256_after", + "standards_state_sha256_before", "upstream_source_ref", + "upstream_revision_id", )) -# The four instantiable K00/03 cells: field -> (row label, placeholder). -STATE_CELLS = { - "standards_version": ("Standards version", "{{ standards_version }}"), - "standards_status": ("Status", "{{ standards_status }}"), - "standards_effective_date": ( - "Effective date", "{{ standards_effective_date }}"), - "selected_profile_manifest": ( - "Selected profile manifest", "{{ selected_profile_manifest }}"), -} - -CHANGE_SUMMARY_HEADER = ( - "| Version | Date | Change | Changed predicates | Adoption requirement |" -) -CHANGE_SUMMARY_SEPARATOR = "|---|---|---|---|---|" - -SIZE_REGISTER_ROW_RE = re.compile( - r"^(\| \[\[kernel/K00 Standards Control/03 Standards Governance" - r"\\\|[^\]]*\]\] \| )([0-9]+)( bytes \|)", - re.M, -) - # The four producer steps, in README "Adopt Cambium" step-4 order. Each entry # is (step name, script under /Tools, extra arguments builder). COMPOSER_STEPS = ( @@ -218,9 +168,9 @@ def load_plan(root, plan_argument): def validate_plan_values(plan, plan_relative): - if plan.get("schema_version") != 1 or \ + if plan.get("schema_version") != 2 or \ type(plan.get("schema_version")) is not int: - raise AdoptionRefusal("plan schema_version must be integer 1") + raise AdoptionRefusal("plan schema_version must be integer 2") plan_id = _string_field(plan, "plan_id") if not PLAN_ID_RE.fullmatch(plan_id): raise AdoptionRefusal( @@ -238,12 +188,12 @@ def validate_plan_values(plan, plan_relative): value = _string_field(plan, field) if "|" in value or "\n" in value or "{{" in value: raise AdoptionRefusal( - "plan field %s must be one instantiated Markdown cell " + "plan field %s must be one instantiated scalar value " "value (no `|`, newline, or `{{`): %r" % (field, value)) if plan["standards_status_after"] != "approved": raise AdoptionRefusal( "standards_status_after must be exactly `approved`; this writer " - "records only released governance (K00/03 lifecycle)") + "records only an approved adopter state") if not DATE_RE.fullmatch(plan["standards_effective_date_after"]): raise AdoptionRefusal( "standards_effective_date_after must be an ISO date YYYY-MM-DD; " @@ -280,6 +230,15 @@ def validate_plan_values(plan, plan_relative): raise AdoptionRefusal( "plan field %s must be one canonical sha256: " "fingerprint; found %r" % (field, value)) + source = plan.get("upstream_source_ref") + revision = plan.get("upstream_revision_id") + if (source is None) != (revision is None): + raise AdoptionRefusal( + "upstream_source_ref and upstream_revision_id must both be null " + "or both be non-empty") + if source is not None: + _string_field(plan, "upstream_source_ref") + _string_field(plan, "upstream_revision_id") before_version = plan.get("standards_version_before") before_manifest = plan.get("selected_profile_manifest_before") if branch == BRANCH_INITIAL: @@ -289,6 +248,9 @@ def validate_plan_values(plan, plan_relative): "an explicit null pair; found standards_version_before=%r " "selected_profile_manifest_before=%r" % (before_version, before_manifest)) + if plan.get("standards_state_sha256_before") is not None: + raise AdoptionRefusal( + "initial-adoption requires standards_state_sha256_before: null") else: for field in ("standards_version_before", "selected_profile_manifest_before"): @@ -296,9 +258,13 @@ def validate_plan_values(plan, plan_relative): if before_version == version_after: raise AdoptionRefusal( "profile-revision must bump standards_version: before and " - "after are both %r (K00/03: changing the selected profile " + "after are both %r (changing the selected profile " "manifest or its content always requires a bump)" % version_after) + state_sha = _string_field(plan, "standards_state_sha256_before") + if not SHA_RE.fullmatch(state_sha): + raise AdoptionRefusal( + "standards_state_sha256_before must be a SHA-256") # --------------------------------------------------------------------------- @@ -307,17 +273,20 @@ def validate_plan_values(plan, plan_relative): def find_runtime_namespace(root): - """Return the first `.cambium/` path under root, or None.""" - for current, directories, _files in os.walk(root): + """Return the first task-runtime state namespace, or None. + + Governance state and adoption receipts may exist before a task runtime; + their `.cambium/` parent is not itself evidence that a task exists. + """ + for current, directories, files in os.walk(root): directories[:] = sorted( name for name in directories if name != ".git" and not name.startswith(STAGING_PREFIX)) - if RUNTIME_NAMESPACE in directories: + if (os.path.basename(current) == "state" and + os.path.basename(os.path.dirname(current)) == RUNTIME_NAMESPACE): return os.path.relpath( - os.path.join(current, RUNTIME_NAMESPACE), + os.path.dirname(current), root).replace(os.sep, "/") - directories[:] = [ - name for name in directories if name != RUNTIME_NAMESPACE] return None @@ -339,59 +308,44 @@ def read_governance(root): text = raw.decode("utf-8") except UnicodeError as exc: raise AdoptionRefusal("%s is not UTF-8: %s" % (GOVERNANCE_PATH, exc)) - state, errors = kblib.active_standards_state(text) + return path, raw, text + + +def read_current_state(root): + """Return current adopter state and bytes, or the absent initial state.""" + absolute = os.path.join(root, *standards_state.STATE_PATH.split("/")) + if not os.path.lexists(absolute): + return None, None + state, view, errors = standards_state.snapshot(root) if errors: - raise AdoptionRefusal( - "%s Standards Control state is malformed: %s" - % (GOVERNANCE_PATH, "; ".join(errors))) - return path, raw, text, state + raise AdoptionRefusal("current adopter Standards state is invalid: %s" % + "; ".join(errors)) + with open(absolute, "rb") as handle: + raw = handle.read() + if kblib.sha256_bytes(raw) != view["active_standards_sha256"]: + raise AdoptionRefusal("current adopter Standards state changed while read") + return state, raw def check_branch_state(plan, state): - """The plan's declared branch must match the actual K00/03 state.""" - placeholder_fields = sorted( - field for field, (_label, placeholder) in STATE_CELLS.items() - if state.get(field) == placeholder) - instantiated_fields = sorted( - field for field in STATE_CELLS if field not in placeholder_fields) - partially = [field for field in instantiated_fields - if "{{" in (state.get(field) or "")] - if partially: - raise AdoptionRefusal( - "%s is partially instantiated (%s carry an uninstantiated " - "`{{ ... }}` value that is not the canonical placeholder); " - "repair the Standards Control table before adoption" - % (GOVERNANCE_PATH, ", ".join(partially))) + """The plan's branch must match absent/present adopter state.""" if plan["branch"] == BRANCH_INITIAL: - if not instantiated_fields: + if state is None: return - if not placeholder_fields: - raise AdoptionRefusal( - "branch initial-adoption does not match %s: all four " - "Standards Control values are already instantiated; a later " - "change is branch profile-revision" % GOVERNANCE_PATH) raise AdoptionRefusal( - "branch initial-adoption requires all four K00/03 placeholders " - "uninstantiated; already instantiated: %s" - % ", ".join(instantiated_fields)) - if placeholder_fields: - if len(placeholder_fields) == len(STATE_CELLS): - raise AdoptionRefusal( - "branch profile-revision does not match %s: all four " - "Standards Control values are still placeholders; the first " - "governance release is branch initial-adoption" - % GOVERNANCE_PATH) + "branch initial-adoption requires absent adopter Standards state; " + "a current state already exists") + if state is None: raise AdoptionRefusal( - "branch profile-revision requires all four K00/03 values " - "instantiated; still placeholders: %s" - % ", ".join(placeholder_fields)) + "branch profile-revision requires an existing adopter Standards " + "state; use initial-adoption first") for plan_field, state_field in ( ("standards_version_before", "standards_version"), ("selected_profile_manifest_before", "selected_profile_manifest")): if plan[plan_field] != state.get(state_field): raise AdoptionRefusal( - "plan %s=%r does not match current K00/03 %s=%r" + "plan %s=%r does not match current adopter state %s=%r" % (plan_field, plan[plan_field], state_field, state.get(state_field))) @@ -452,72 +406,21 @@ def _replace_exactly_once(text, old, new, label): return text.replace(old, new, 1) -def governance_after_text(plan, state, text): - """The K00/03 after-image: four cells replaced, one row appended.""" - after_values = { +def build_commit_stub(plan, transaction_id): + identity = { "standards_version": plan["standards_version_after"], - "standards_status": plan["standards_status_after"], - "standards_effective_date": plan["standards_effective_date_after"], "selected_profile_manifest": plan["selected_profile_manifest_after"], } - for field, (label, _placeholder) in STATE_CELLS.items(): - old = "| %s | `%s` |" % (label, state[field]) - new = "| %s | `%s` |" % (label, after_values[field]) - text = _replace_exactly_once( - text, old, new, "%s Standards Control row" % GOVERNANCE_PATH) - lines = text.splitlines(keepends=True) - stripped = [line.rstrip("\n") for line in lines] - header_indexes = [index for index, line in enumerate(stripped) - if line == CHANGE_SUMMARY_HEADER] - if len(header_indexes) != 1: - raise AdoptionRefusal( - "%s must carry exactly one Change Summary table header; found %d" - % (GOVERNANCE_PATH, len(header_indexes))) - index = header_indexes[0] - if index + 1 >= len(stripped) or \ - stripped[index + 1] != CHANGE_SUMMARY_SEPARATOR: - raise AdoptionRefusal( - "%s Change Summary header is not followed by its separator row" - % GOVERNANCE_PATH) - insert_at = index + 2 - while insert_at < len(stripped) and stripped[insert_at].startswith("|"): - insert_at += 1 - row = "| %s | %s | %s | none | none |\n" % ( - plan["standards_version_after"], - plan["standards_effective_date_after"], - plan["change_summary"]) - if lines and not lines[-1].endswith("\n"): - lines[-1] += "\n" - lines.insert(insert_at, row) - return "".join(lines), row.rstrip("\n") - - -def size_register_after_text(root, after_size): - """The mechanical K00/16 re-measure for K00/03, when a row registers it. - - The Revision Write-back Checklist (K00/03) names the K00/16 measured - values as a snapshot location synchronized by the same revision that - changes a leaf's size. Only the one integer cell is rewritten; the - growth cap and every judgment stay untouched, and `stamp_cards --check` - remains the canonical gate over the result. - """ - path = os.path.join(root, *SIZE_REGISTER_PATH.split("/")) - if not os.path.isfile(path): - return None, None - with open(path, encoding="utf-8", errors="strict") as handle: - text = handle.read() - matches = list(SIZE_REGISTER_ROW_RE.finditer(text)) - if not matches: - return None, None - if len(matches) > 1: - raise AdoptionRefusal( - "%s registers %s more than once; repair the register before " - "adoption" % (SIZE_REGISTER_PATH, GOVERNANCE_PATH)) - match = matches[0] - if int(match.group(2)) == after_size: - return None, None - after = text[:match.start(2)] + str(after_size) + text[match.end(2):] - return path, after + receipt = kblib.make_receipt( + TOOL, TOOL_VERSION, "profile_adoption", plan["plan_id"], "pass", + "R09 %s committed: %s -> %s; %s" % ( + plan["branch"], + plan["standards_version_before"] or "(uninstantiated)", + plan["standards_version_after"], + plan["selected_profile_manifest_after"]), + 1, identity=identity) + receipt["transaction_id"] = transaction_id + return receipt # --------------------------------------------------------------------------- @@ -558,7 +461,7 @@ def write_journal(staging, journal): def touched_paths(root): """Every repo-relative path the transaction may write, sorted.""" - paths = [GOVERNANCE_PATH, SIZE_REGISTER_PATH, + paths = [standards_state.STATE_PATH, RECEIPT_RELATIVE, VOCAB_ARTIFACT, PAGE_CONTRACT_ARTIFACT] cards_dir = os.path.join(root, *CARDS_DIR.split("/")) for current, directories, files in os.walk(cards_dir): @@ -649,6 +552,19 @@ def restore_from_staging(root, staging, journal): os.unlink(absolute) except (OSError, UnicodeError) as exc: failures.append("%s: %s" % (relative, exc)) + # Initial adoption may have created the governance/receipt directories + # before a later producer failed. Remove only directories that are now + # empty, so rollback restores the pre-adoption namespace shape without + # touching any pre-existing history or state. + for relative in ( + ".cambium/governance", ".cambium/receipts", ".cambium"): + absolute = os.path.join(root, *relative.split("/")) + if os.path.isdir(absolute) and not os.path.islink(absolute): + try: + os.rmdir(absolute) + except OSError as exc: + if exc.errno not in (errno.ENOTEMPTY, errno.EEXIST): + failures.append("%s cleanup: %s" % (relative, exc)) cards_dir = os.path.join(root, *CARDS_DIR.split("/")) if os.path.isdir(cards_dir): for current, directories, files in os.walk(cards_dir): @@ -678,6 +594,12 @@ def restore_from_staging(root, staging, journal): failures.append( "%s still exists after restoration but was absent before" % relative) + for relative in (".cambium/governance", ".cambium/receipts", ".cambium"): + absolute = os.path.join(root, *relative.split("/")) + try: + os.rmdir(absolute) + except OSError: + pass return failures @@ -709,14 +631,7 @@ def build_receipts(prepared): "selected_profile_manifest": plan["selected_profile_manifest_after"], } - commit = kblib.make_receipt( - TOOL, TOOL_VERSION, "profile_adoption", plan["plan_id"], "pass", - "R09 %s committed: %s -> %s; %s" - % (plan["branch"], - plan["standards_version_before"] or "(uninstantiated)", - plan["standards_version_after"], - plan["selected_profile_manifest_after"]), - 1, identity=identity) + commit = dict(prepared["commit_stub"]) commit.update({ "transaction_id": prepared["transaction_id"], "branch": plan["branch"], @@ -732,7 +647,12 @@ def build_receipts(prepared): "selected_profile_manifest_after": plan["selected_profile_manifest_after"], "k00_03_sha256_before": plan["k00_03_sha256_before"], - "k00_03_sha256_after": prepared["governance_after_sha"], + "k00_03_sha256_after": plan["k00_03_sha256_before"], + "standards_state_sha256_before": + plan["standards_state_sha256_before"], + "standards_state_sha256_after": prepared["state_after_sha"], + "upstream_source_ref": plan["upstream_source_ref"], + "upstream_revision_id": plan["upstream_revision_id"], "profile_snapshot_sha256_after": plan["profile_snapshot_sha256_after"], "profile_contract_fingerprint_after": @@ -772,17 +692,27 @@ def commit_transaction(prepared): if live_sha != plan["k00_03_sha256_before"]: raise TransactionError( "%s changed between validation and staging" % GOVERNANCE_PATH) + live_state_path = os.path.join( + root, *standards_state.STATE_PATH.split("/")) + if plan["standards_state_sha256_before"] is None: + if os.path.lexists(live_state_path): + raise TransactionError( + "%s appeared between validation and staging" % + standards_state.STATE_PATH) + elif (not os.path.isfile(live_state_path) or + kblib.sha256_file(live_state_path) != + plan["standards_state_sha256_before"]): + raise TransactionError( + "%s changed between validation and staging" % + standards_state.STATE_PATH) journal["status"] = "writing" write_journal(staging, journal) + state_path = os.path.join(root, *standards_state.STATE_PATH.split("/")) + os.makedirs(os.path.dirname(state_path), exist_ok=True) kblib.atomic_write_text( - os.path.join(root, *GOVERNANCE_PATH.split("/")), - prepared["governance_after"]) - _journal_step(staging, journal, "write-k00-03", "done") - if prepared["register_after"] is not None: - kblib.atomic_write_text( - prepared["register_path"], prepared["register_after"]) - _journal_step(staging, journal, "write-k00-16", "done", - "measured value re-synchronized") + state_path, prepared["state_after_text"], + validator=kblib.parse_yaml_subset) + _journal_step(staging, journal, "write-standards-state", "done") for step, script, argument_builder in COMPOSER_STEPS: # -B: a producer step must not drop bytecode caches into the # adopter repository; after an abort the tree is byte-identical. @@ -810,6 +740,7 @@ def commit_transaction(prepared): journal["receipts_path"] = prepared["receipts_path"] journal["receipts"] = receipts write_journal(staging, journal) + os.makedirs(os.path.dirname(prepared["receipts_path"]), exist_ok=True) kblib.write_receipts(prepared["receipts_path"], receipts) journal["status"] = "committed" write_journal(staging, journal) @@ -912,42 +843,21 @@ def recover_staging(root, staging_name, plan_sha, apply_mode, printer): def resolve_receipts_path(root, plan_path, plan, receipts_argument): - """Non-runtime receipt destination: alongside the plan by default. - - The runtime receipt register `.cambium/receipts/` is exclusively for - tools operating inside a runtime, and this tool exists only where no - runtime does; `kblib.validate_receipt_output_path` additionally rejects - any `.cambium` spelling. The plan is the canonical machine revision - record of this adoption, so its transaction evidence defaults to sitting - beside it, the way `apply_delta.py` names a per-transaction receipt file. - """ + """Resolve the one canonical Standards-adoption history stream.""" if receipts_argument: - path = os.path.abspath(os.fspath(receipts_argument)) + relative = os.fspath(receipts_argument).replace(os.sep, "/") else: - base = plan_path[:-len(".yaml")] if plan_path.endswith(".yaml") \ - else plan_path - path = base + ".receipts.jsonl" - if not path.endswith(".jsonl"): - raise AdoptionRefusal("--receipts must name a .jsonl file") + relative = RECEIPT_RELATIVE + if relative != RECEIPT_RELATIVE: + raise AdoptionRefusal( + "--receipts must be the canonical history stream %s" % + RECEIPT_RELATIVE) try: - path = kblib.validate_receipt_output_path(path) + return kblib.managed_repository_path( + root, relative, ".cambium/receipts", suffixes=(".jsonl",), + must_exist=False) except ValueError as exc: raise AdoptionRefusal("invalid --receipts destination: %s" % exc) - relative = os.path.relpath(path, root).replace(os.sep, "/") - if not relative.startswith(".."): - parts = relative.split("/") - profile_dir = os.path.dirname( - plan["selected_profile_manifest_after"]) - if parts[0] == "kernel": - raise AdoptionRefusal( - "--receipts must stay outside kernel/; the transaction " - "writes there and evidence must not mutate it") - if relative.startswith(profile_dir + "/"): - raise AdoptionRefusal( - "--receipts must stay outside the candidate Profile " - "directory so evidence cannot mutate the package whose " - "snapshot it binds") - return path def prepare(root, plan_argument, receipts_argument): @@ -964,8 +874,8 @@ def prepare(root, plan_argument, receipts_argument): ".cambium/deltas/standards-adoptions/ and apply it with " "Tools/adopt_standards.py" % runtime) require_tools(root) - governance_path, governance_raw, governance_text, state = \ - read_governance(root) + governance_path, governance_raw, _governance_text = read_governance(root) + state, state_raw = read_current_state(root) check_branch_state(plan, state) live_sha = kblib.sha256_bytes(governance_raw) if live_sha != plan["k00_03_sha256_before"]: @@ -975,11 +885,27 @@ def prepare(root, plan_argument, receipts_argument): "plan was prepared -- re-prepare the plan against the current " "bytes" % (GOVERNANCE_PATH, live_sha, plan["k00_03_sha256_before"])) + observed_state_sha = ( + kblib.sha256_bytes(state_raw) if state_raw is not None else None) + if observed_state_sha != plan["standards_state_sha256_before"]: + raise AdoptionRefusal( + "current %s fingerprint %r does not match " + "standards_state_sha256_before %r" % ( + standards_state.STATE_PATH, observed_state_sha, + plan["standards_state_sha256_before"])) evaluation = evaluate_candidate(root, plan) - governance_after, change_row = governance_after_text( - plan, state, governance_text) - register_path, register_after = size_register_after_text( - root, len(governance_after.encode("utf-8"))) + transaction_id = "txn-%s-%s" % (plan["plan_id"], uuid.uuid4().hex) + commit_stub = build_commit_stub(plan, transaction_id) + state_after = standards_state.next_state( + state, + standards_version=plan["standards_version_after"], + effective_date=plan["standards_effective_date_after"], + selected_profile_manifest=plan["selected_profile_manifest_after"], + latest_adoption_receipt=commit_stub["receipt_id"], + upstream_source_ref=plan["upstream_source_ref"], + upstream_revision_id=plan["upstream_revision_id"], + ) + state_after_text = standards_state.canonical_text(state_after) return { "root": root, "plan": plan, @@ -988,13 +914,12 @@ def prepare(root, plan_argument, receipts_argument): "plan_sha": plan_sha, "receipts_path": receipts_path, "state": state, - "governance_after": governance_after, - "governance_after_sha": kblib.sha256_bytes(governance_after), - "change_row": change_row, - "register_path": register_path, - "register_after": register_after, + "state_after": state_after, + "state_after_text": state_after_text, + "state_after_sha": kblib.sha256_bytes(state_after_text), + "commit_stub": commit_stub, "evaluation": evaluation, - "transaction_id": "txn-%s-%s" % (plan["plan_id"], uuid.uuid4().hex), + "transaction_id": transaction_id, } @@ -1003,8 +928,8 @@ def main(argv=None): description="Apply one no-runtime R09 Profile adoption (initial " "adoption or pre-runtime profile revision) from a " "restricted-YAML plan") - parser.add_argument("root", help="repository root (no .cambium/ may " - "exist anywhere under it)") + parser.add_argument("root", help="repository root (no task runtime may " + "exist; governance state may exist)") parser.add_argument("--plan", required=True, help="root-relative adoption plan " "(schemas/profile_adoption_plan.template.yaml)") @@ -1015,9 +940,8 @@ def main(argv=None): parser.add_argument("--json", action="store_true", help="emit the plan/result as one JSON document") parser.add_argument("--receipts", default=None, - help="transaction receipt JSONL destination " - "(default: .receipts.jsonl beside the " - "plan; never .cambium/)") + help="must be the canonical Standards history stream " + ".cambium/receipts/standards-adoptions.jsonl") args = parser.parse_args(argv) report = { @@ -1057,7 +981,7 @@ def refuse(message): return refuse("root is not an existing directory: %s" % args.root) # Interrupted-transaction handling comes before every state judgment: - # a half-written K00/03 must be recovered from its journal, never + # a half-written adopter state must be recovered from its journal, never # re-diagnosed as a branch mismatch. try: plan_path, _rel, plan_raw, _plan = load_plan(root, args.plan) @@ -1090,15 +1014,17 @@ def refuse(message): "selected_profile_manifest_after": plan["selected_profile_manifest_after"], "k00_03_sha256_before": plan["k00_03_sha256_before"], - "k00_03_sha256_after": prepared["governance_after_sha"], + "k00_03_sha256_after": plan["k00_03_sha256_before"], + "standards_state_sha256_before": + plan["standards_state_sha256_before"], + "standards_state_sha256_after": prepared["state_after_sha"], "profile_snapshot_sha256_after": plan["profile_snapshot_sha256_after"], "profile_contract_fingerprint_after": plan["profile_contract_fingerprint_after"], "profile_load_inputs_sha256_after": plan["profile_load_inputs_sha256_after"], - "change_summary_row": prepared["change_row"], - "size_register_resync": prepared["register_after"] is not None, + "history_record": "append-only receipt", "receipts_path": os.path.relpath( prepared["receipts_path"], root).replace(os.sep, "/"), }) @@ -1110,12 +1036,13 @@ def refuse(message): say(" selected_profile_manifest: %s -> %s" % ( plan["selected_profile_manifest_before"] or "(uninstantiated)", plan["selected_profile_manifest_after"])) - say(" %s: %s -> %s" % (GOVERNANCE_PATH, plan["k00_03_sha256_before"], - prepared["governance_after_sha"])) - say(" Change Summary row: %s" % prepared["change_row"]) - if prepared["register_after"] is not None: - say(" %s: K00/03 measured value re-synchronized" % - SIZE_REGISTER_PATH) + say(" normative Kernel binding %s: %s (unchanged)" % ( + GOVERNANCE_PATH, plan["k00_03_sha256_before"])) + say(" %s: %r -> %s" % ( + standards_state.STATE_PATH, + plan["standards_state_sha256_before"], + prepared["state_after_sha"])) + say(" history: append one transaction record; Kernel remains rules-only") say(" candidate profile-load: snapshot=%s contract=%s inputs=%s" % ( plan["profile_snapshot_sha256_after"], plan["profile_contract_fingerprint_after"], diff --git a/Tools/check_boundary_contract.py b/Tools/check_boundary_contract.py index 1138253..1586327 100644 --- a/Tools/check_boundary_contract.py +++ b/Tools/check_boundary_contract.py @@ -133,7 +133,7 @@ def _json_finish(answered): "unchanged") -ACTIVE_STATE_PATH = "kernel/K00 Standards Control/03 Standards Governance.md" +ACTIVE_STATE_PATH = ".cambium/governance/standards_state.yaml" SCOPE_SLOT = "Profile Scope" BEGIN = kblib.BOUNDARY_PROJECTION_BEGIN END = kblib.BOUNDARY_PROJECTION_END diff --git a/Tools/check_page_contract.py b/Tools/check_page_contract.py index 7292452..2a400b2 100644 --- a/Tools/check_page_contract.py +++ b/Tools/check_page_contract.py @@ -135,7 +135,7 @@ def _json_finish(answered): "unchanged") -ACTIVE_STATE_PATH = "kernel/K00 Standards Control/03 Standards Governance.md" +ACTIVE_STATE_PATH = ".cambium/governance/standards_state.yaml" SCOPE_SLOT = "Profile Scope" COVERAGE_LEDGER_PATH = ".cambium/state/coverage_ledger.yaml" DATE_RE = re.compile(r"^\d{4}-\d{2}-\d{2}$") diff --git a/Tools/check_proof.py b/Tools/check_proof.py index db9b9a4..8a45573 100644 --- a/Tools/check_proof.py +++ b/Tools/check_proof.py @@ -79,7 +79,7 @@ is claimed; - when --ledger (Coverage Ledger) is given, cross-check: open_gaps non-empty while the proof claims required_authoring_gaps=0 -> fail; -- --root requires an instantiated, approved K00/03 active state, +- --root requires an instantiated, approved canonical adopter Standards state, --progress-ledger, and --ledger; the active state, frozen contract, Coverage, Queue, and Terminal Proof must carry the same task, scope, Standards, and profile identity, while Proof and Progress also agree on the @@ -243,7 +243,7 @@ def _make_receipt(tool, tool_version, check, target, result, details, seq): REGISTRY_ID = "kernel-runtime-routes" CARD_INDEX_PATH = "kernel/Cards/Card Index.md" READ_SET_INDEX_PATH = "kernel/Read Sets/Read Sets Index.md" -ACTIVE_STATE_PATH = "kernel/K00 Standards Control/03 Standards Governance.md" +ACTIVE_STATE_PATH = ".cambium/governance/standards_state.yaml" UNINSTANTIATED_RE = re.compile(r"\{\{.*?\}\}") SHA256_RE = re.compile(r"sha256:[0-9a-f]{64}\Z") CANONICAL_COVERAGE_PATH = ".cambium/state/coverage_ledger.yaml" @@ -2769,7 +2769,7 @@ def _main(): "not-applicable%s%s%s%s%s%s%s" % ( len(required_fields), len(required_fields), route_summary, profile_summary, - ", consistent with the active K00/03 Standards state" + ", consistent with the canonical adopter Standards state" if active_state_checked else "", ", consistent with the frozen Progress Ledger contract" if args.progress_ledger else "", diff --git a/Tools/check_queue.py b/Tools/check_queue.py index 6441cf6..9b0a22f 100644 --- a/Tools/check_queue.py +++ b/Tools/check_queue.py @@ -43,6 +43,7 @@ import metadata_execution_contract import metadata_property_state import project_page_state +import standards_state TOOL = "check_queue" TOOL_VERSION = "1.23.0" @@ -87,8 +88,7 @@ QUEUE_PATH = ".cambium/state/required_queue.yaml" COVERAGE_PATH = ".cambium/state/coverage_ledger.yaml" PROGRESS_PATH = ".cambium/state/progress_ledger.yaml" -ACTIVE_STANDARDS_PATH = ( - "kernel/K00 Standards Control/03 Standards Governance.md") +ACTIVE_STANDARDS_PATH = standards_state.STATE_PATH WORK_SPEC_PREFIX = ".cambium/work_specs" WORK_SPEC_FIELDS = frozenset(("work_spec_path", "work_spec_sha256")) WORK_SPEC_TOP_LEVEL_FIELDS = frozenset(( @@ -272,6 +272,10 @@ "before": ("before_progress_sha256",), "planned_after": ("planned_after_progress_sha256",), }, + "standards": { + "before": ("before_standards_state_sha256",), + "planned_after": ("planned_after_standards_state_sha256",), + }, } GENERIC_WRITER_TOOLS = frozenset(( "apply_delta", "update_queue", "compile_queue", "update_task", @@ -493,7 +497,7 @@ "id", "date", "summary", "status", "writeback_done", )) STANDARDS_ADOPTION_TOOL = "adopt_standards" -STANDARDS_ADOPTION_TOOL_VERSION = "1.6.0" +STANDARDS_ADOPTION_TOOL_VERSION = "1.7.0" STANDARDS_ADOPTION_PROFILE_CONTRACT_MIN_VERSION = (1, 3, 0) # The 1.5 producer records where the adopted revision came from: the # distribution has no version numbers by design, so upstream/downstream @@ -599,6 +603,8 @@ # (for a git upstream, the commit hash), or both null, which DECLARES # that this adoption tracks no upstream. Absent is not an answer. "upstream_source_ref", "upstream_revision_id", + # 1.7 producer: instance state is no longer embedded in K00/03. + "standards_state_sha256_before", "standards_effective_date_after", )) STANDARDS_CHANGED_PREDICATE_FIELDS = frozenset(( "predicate_id", "owner_path", "change_kind", "affected_gate_ids", @@ -632,6 +638,8 @@ "immediate_gate_reruns", "immediate_gate_receipts", "boundary_gate_reruns", "upstream_source_ref", "upstream_revision_id", + "standards_state_sha256_before", "standards_effective_date_after", + "after_standards_state_sha256", )) @@ -3880,6 +3888,17 @@ def _standards_adoption_owner_projection_required(producer_tool_version): STANDARDS_ADOPTION_OWNER_PROJECTION_MIN_VERSION +def _standards_adoption_state_file_required(producer_tool_version): + """Return whether this era owns adopter identity in the state file.""" + match = re.fullmatch( + r"(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)", + str(producer_tool_version), + ) + if match is None: + return True + return tuple(int(part) for part in match.groups()) >= (1, 7, 0) + + def standards_adoption_plan_errors( root, plan, catalog=None, queue=None, progress=None, validate_current=True, @@ -3901,6 +3920,8 @@ def standards_adoption_plan_errors( _standards_adoption_upstream_required(producer_tool_version) owner_projection_era = validate_current or \ _standards_adoption_owner_projection_required(producer_tool_version) + state_file_required = validate_current or \ + _standards_adoption_state_file_required(producer_tool_version) optional_fields = [] if not profile_contract_required: optional_fields.append("profile_contract_fingerprint_after") @@ -3909,13 +3930,20 @@ def standards_adoption_plan_errors( if not upstream_required: optional_fields.extend( ("upstream_source_ref", "upstream_revision_id")) + if not state_file_required: + optional_fields.extend(( + "standards_state_sha256_before", + "standards_effective_date_after", + )) errors = _closed_mapping_errors( plan, "Standards adoption plan", STANDARDS_ADOPTION_PLAN_FIELDS, optional_fields=tuple(optional_fields)) if not isinstance(plan, dict): return errors - if plan.get("schema_version") != 1: - errors.append("Standards adoption plan schema_version must be 1") + expected_schema = 2 if state_file_required else 1 + if plan.get("schema_version") != expected_schema: + errors.append("Standards adoption plan schema_version must be %d" % + expected_schema) for field in ( "adoption_id", "task_id", "task_state_before", "contract_version_before", "contract_version_after", @@ -3944,6 +3972,16 @@ def standards_adoption_plan_errors( "Standards adoption plan upstream_source_ref and " "upstream_revision_id must be non-empty strings or an " "explicit null pair declaring no upstream") + if state_file_required: + effective = plan.get("standards_effective_date_after") + try: + parsed_effective = datetime.date.fromisoformat(str(effective)) + except ValueError: + parsed_effective = None + if parsed_effective is None or parsed_effective.isoformat() != effective: + errors.append( + "Standards adoption plan standards_effective_date_after " + "must be YYYY-MM-DD") if (plan.get("standards_version_before") == plan.get("standards_version_after")): errors.append("Standards adoption must change standards_version") @@ -3966,6 +4004,8 @@ def standards_adoption_plan_errors( "profile_snapshot_sha256_after", "coverage_sha256_before", "required_queue_sha256_before", "progress_sha256_before", ] + if state_file_required: + digest_fields.append("standards_state_sha256_before") if (profile_contract_required or "profile_contract_fingerprint_after" in plan): digest_fields.append("profile_contract_fingerprint_after") @@ -3999,29 +4039,33 @@ def standards_adoption_plan_errors( try: governance_path = kblib.repository_path( root, governance, must_exist=True, reject_symlink=True) - with open(governance_path, encoding="utf-8") as fh: - governance_text = fh.read() governance_sha = kblib.sha256_file(governance_path) - active_state, state_errors = kblib.active_standards_state( - governance_text) - errors.extend("governance revision: %s" % error - for error in state_errors) if governance_sha != plan.get("governance_revision_sha256"): errors.append("governance_revision_sha256 does not bind " - "the active K00/03 bytes") - if active_state.get("standards_status") != "approved": - errors.append("K00/03 Standards status must be approved") - if active_state.get("standards_version") != plan.get( - "standards_version_after"): - errors.append("K00/03 Standards version does not match the " - "plan after version") - if active_state.get("selected_profile_manifest") != plan.get( - "selected_profile_manifest_after"): - errors.append("K00/03 selected profile does not match the " - "plan after profile") + "the approved K00/03 rule bytes") except (OSError, UnicodeError, ValueError) as exc: errors.append("governance revision is unsafe or unreadable: %s" % exc) + if state_file_required: + current_state, current_view, state_errors = \ + standards_state.snapshot(root) + errors.extend("active Standards state: %s" % error + for error in state_errors) + if current_view is not None: + if current_view["active_standards_sha256"] != plan.get( + "standards_state_sha256_before"): + errors.append( + "standards_state_sha256_before is stale") + if current_state.get("standards_version") != plan.get( + "standards_version_before"): + errors.append( + "active Standards state does not match plan before " + "version") + if current_state.get("selected_profile_manifest") != plan.get( + "selected_profile_manifest_before"): + errors.append( + "active Standards state does not match plan before " + "Profile") after_profile = plan.get("selected_profile_manifest_after") if _nonempty_string(after_profile): profile_evidence, profile_errors = profile_load_evidence( @@ -4700,7 +4744,8 @@ def standards_adoption_plan_errors( return errors -def _standards_adoption_errors(root, progress, catalog, queue): +def _standards_adoption_errors( + root, progress, catalog, queue, active_standards_view=None): """Validate plan/record/commit bindings for all persisted adoptions.""" records = progress.get("standards_adoptions") if not isinstance(records, list): @@ -4774,6 +4819,17 @@ def _standards_adoption_errors(root, progress, catalog, queue): "adoption record is what makes upstream and " "downstream comparable" % (label, field, producer_tool_version)) + state_file_required = _standards_adoption_state_file_required( + producer_tool_version) + if state_file_required: + for field in ( + "standards_effective_date_after", + "standards_state_sha256_before", + "after_standards_state_sha256"): + if field not in record: + errors.append( + "%s misses %s required by adopt_standards %s" % + (label, field, producer_tool_version)) errors.extend("%s %s" % (label, error) for error in standards_adoption_plan_errors( root, plan, catalog=catalog, queue=queue, @@ -4825,6 +4881,13 @@ def _standards_adoption_errors(root, progress, catalog, queue): "immediate_gate_reruns": "immediate_gate_reruns", "boundary_gate_reruns": "boundary_gate_reruns", } + if state_file_required: + record_plan_fields.update({ + "standards_effective_date_after": + "standards_effective_date_after", + "standards_state_sha256_before": + "standards_state_sha256_before", + }) for record_field, plan_field in record_plan_fields.items(): if record.get(record_field) != plan.get(plan_field): errors.append("%s %s does not match its plan" % @@ -4882,6 +4945,15 @@ def _standards_adoption_errors(root, progress, catalog, queue): "upstream_source_ref": "upstream_source_ref", "upstream_revision_id": "upstream_revision_id", } + if state_file_required: + receipt_bindings.update({ + "before_standards_state_sha256": + "standards_state_sha256_before", + "after_standards_state_sha256": + "after_standards_state_sha256", + "standards_effective_date_after": + "standards_effective_date_after", + }) for receipt_field, record_field in receipt_bindings.items(): if receipt.get(receipt_field) != record.get(record_field): errors.append("%s receipt %s does not match record %s" % @@ -4939,6 +5011,20 @@ def _standards_adoption_errors(root, progress, catalog, queue): previous = record if records and isinstance(records[-1], dict): latest = records[-1] + if active_standards_view is not None: + if (active_standards_view.get("latest_adoption_receipt") != + latest.get("verification_receipt")): + errors.append( + "canonical Standards state latest_adoption_receipt does " + "not match latest Progress adoption") + expected_state_sha = latest.get( + "after_standards_state_sha256") + if (expected_state_sha is not None and + active_standards_view.get("active_standards_sha256") != + expected_state_sha): + errors.append( + "canonical Standards state bytes do not match latest " + "Progress adoption") contract = progress.get("contract") if isinstance( progress.get("contract"), dict) else {} # A K13/06 Contract Amendment is the other guarded writer of the @@ -10381,67 +10467,54 @@ def _public_profile_load_evidence(authorized_view): def active_standards_authorized_view(root, standards_version, - selected_profile_manifest): - """Return one immutable approved K00/03 identity view and its errors.""" - root = os.path.realpath(os.path.abspath(os.fspath(root))) - try: - snapshot = kblib.repository_file_snapshot( - root, ACTIVE_STANDARDS_PATH, singly_linked=True) - state, parse_errors = kblib.active_standards_state( - snapshot.read_text()) - except (OSError, UnicodeError, ValueError) as exc: - return None, [ - "active Standards Control is unsafe or unreadable: %s" % exc] - errors = [ - "active Standards Control: %s" % error for error in parse_errors] - if state.get("standards_status") != "approved": - errors.append( - "active Standards Control Status must be approved; found %r" % - state.get("standards_status")) + selected_profile_manifest, + state_override=None): + """Return one immutable approved adopter-state view and its errors.""" + state, view, errors = standards_state.snapshot( + root, override_text=state_override) + errors = ["active Standards state: %s" % error for error in errors] + if state is None: + return None, errors if state.get("standards_version") != standards_version: errors.append( - "runtime standards_version %r differs from active K00/03 %r" % + "runtime standards_version %r differs from active state %r" % (standards_version, state.get("standards_version"))) if (state.get("selected_profile_manifest") != selected_profile_manifest): errors.append( "runtime selected_profile_manifest %r differs from active " - "K00/03 %r" % + "state %r" % (selected_profile_manifest, state.get("selected_profile_manifest"))) if errors: return None, errors - return { - "active_standards_path": ACTIVE_STANDARDS_PATH, - "active_standards_sha256": snapshot.sha256, - "standards_version": state.get("standards_version"), - "selected_profile_manifest": state.get( - "selected_profile_manifest"), - }, [] + return view, [] def active_standards_alignment_errors(root, standards_version, selected_profile_manifest): - """Compare runtime identity to the one approved K00/03 authority.""" + """Compare runtime identity to the canonical adopter Standards state.""" _view, errors = active_standards_authorized_view( root, standards_version, selected_profile_manifest) return errors -def active_standards_view_currency_errors(root, authorized_view): - """Fail when K00/03 bytes no longer equal one authorized identity view.""" +def active_standards_view_currency_errors(root, authorized_view, + state_override=None): + """Fail when current-state bytes no longer equal an authorized view.""" if not isinstance(authorized_view, dict): return ["active Standards authorized view must be a mapping"] expected = authorized_view.get("active_standards_sha256") view, errors = active_standards_authorized_view( root, authorized_view.get("standards_version"), - authorized_view.get("selected_profile_manifest")) + authorized_view.get("selected_profile_manifest"), + state_override=state_override) if errors: return errors if view.get("active_standards_sha256") != expected: return [ - "active Standards Control changed after identity admission; " - "rerun against one stable K00/03 revision" + "active Standards state changed after identity admission; " + "rerun against one stable state revision" ] return [] @@ -14066,6 +14139,7 @@ def validate_runtime(root, allowed_open_delta=None, allow_invalid_current_profile_for_corrective_adoption= False, allow_active_standards_mismatch_for_adoption=False, + active_standards_state_override=None, authorized_profile_view=None, authorized_active_standards_view=None): """Return a validation result dict without writing any state. @@ -14090,6 +14164,12 @@ def validate_runtime(root, allowed_open_delta=None, if type(allow_active_standards_mismatch_for_adoption) is not bool: raise TypeError( "allow_active_standards_mismatch_for_adoption must be boolean") + if (active_standards_state_override is not None and + (not isinstance(active_standards_state_override, str) or + state_overrides is None)): + raise ValueError( + "active_standards_state_override must be text and requires " + "proposed state_overrides") if page_projection_overrides is not None: if state_overrides is None or not isinstance(state_overrides, dict) or \ COVERAGE_PATH not in state_overrides: @@ -14270,7 +14350,8 @@ def validate_runtime(root, allowed_open_delta=None, active_standards_view, active_errors = \ active_standards_authorized_view( root, queue.get("standards_version"), - queue.get("selected_profile_manifest")) + queue.get("selected_profile_manifest"), + state_override=active_standards_state_override) else: active_standards_view = authorized_active_standards_view active_errors = [] @@ -14342,6 +14423,8 @@ def validate_runtime(root, allowed_open_delta=None, "coverage": coverage_sha, "queue": queue_sha, "progress": progress_sha, + "standards": (active_standards_view or {}).get( + "active_standards_sha256"), }) _bind_lock_delta_archives(root, writer_locks) _bind_generic_lock_receipts(root, writer_locks, catalog) @@ -14357,7 +14440,7 @@ def validate_runtime(root, allowed_open_delta=None, continue catalog[receipt_id] = ("", receipt) errors.extend(_standards_adoption_errors( - root, progress, catalog, queue)) + root, progress, catalog, queue, active_standards_view)) invalidated_evidence_receipt_ids = { receipt_id for adoption in (progress.get("standards_adoptions") or []) @@ -15070,7 +15153,8 @@ def _assigned_through_successors(item_id, assigned_ids): final_profile_error) if active_standards_view is not None: errors.extend(active_standards_view_currency_errors( - root, active_standards_view)) + root, active_standards_view, + state_override=active_standards_state_override)) return { "root": root, "errors": errors, "ready": ready, "blocked": blocked, "hub_page_admission": hub_admission, diff --git a/Tools/check_structure.py b/Tools/check_structure.py index d0d6a0d..27a1170 100644 --- a/Tools/check_structure.py +++ b/Tools/check_structure.py @@ -126,7 +126,7 @@ def _json_finish(answered): "unchanged") -ACTIVE_STATE_PATH = "kernel/K00 Standards Control/03 Standards Governance.md" +ACTIVE_STATE_PATH = ".cambium/governance/standards_state.yaml" STRUCTURE_SLOT = "Structure Registry" CORPUS_SLOT = "Corpus Planning" SCOPE_SLOT = "Profile Scope" diff --git a/Tools/compiled/cli-contract.yaml b/Tools/compiled/cli-contract.yaml index df65e2a..5abb3dd 100644 --- a/Tools/compiled/cli-contract.yaml +++ b/Tools/compiled/cli-contract.yaml @@ -5,7 +5,7 @@ # by hand, and a hand edit is reported by --check as a HOLD. # regenerate with: python3 Tools/compile_cli_contract.py . # verify with: python3 Tools/compile_cli_contract.py . --check -# `source_hash` covers the manifest of the 45 tool sources listed +# `source_hash` covers the manifest of the 46 tool sources listed # under source_files, each with its own sha256. # A positional argument is one whose `option_strings` is empty. # `choices` is the admissible SET in canonical order, not the @@ -47,6 +47,7 @@ source_files: - Tools/duplicate_check.py - Tools/init_state.py - Tools/metadata_execution_contract.py + - Tools/migrate_standards_state.py - Tools/profile_onboarding_status.py - Tools/project_page_state.py - Tools/record_batch_judgment.py @@ -65,7 +66,7 @@ source_files: - Tools/stamp_cards.py - Tools/update_queue.py - Tools/update_task.py -source_hash: sha256:0851f552ac8080f96d888a5a236abf93aa1b7af5fa541b1bf6e62dfe690a23f6 +source_hash: sha256:f7a5a074561a1740ba5e08dd717c82558da549743c9f2aa5ccfd689120c7cc2c receipt_shape: base_fields: - receipt_id @@ -80,11 +81,11 @@ receipt_shape: conditional_fields: - gate_id extension_policy: derived-per-tool-from-source -tool_count: 45 +tool_count: 46 tools: - tool: adopt_standards module: Tools/adopt_standards.py - source_hash: sha256:38a3854317419437b0fe116051a5511a346f12f35e0fa1a4f38459d60afcd2a7 + source_hash: sha256:40802fbb9a64aca85547656c1bdd10eccbb7fd92fb6b3cea9e79db54cd0fd1c0 description: Adopt one approved Standards/Profile revision arguments: - dest: root @@ -164,12 +165,14 @@ tools: - after_coverage_sha256 - after_progress_sha256 - after_queue_sha256 + - after_standards_state_sha256 - before_contract_scope_version - before_contract_sha256 - before_contract_version - before_coverage_sha256 - before_progress_sha256 - before_queue_sha256 + - before_standards_state_sha256 - boundary_gate_reruns - changed_predicate_ids - contract_version_after @@ -204,6 +207,7 @@ tools: - selected_read_sets_before - selected_route_ids_after - selected_route_ids_before + - standards_effective_date_after - standards_snapshot_sha256_after - standards_version_after - standards_version_before @@ -773,7 +777,7 @@ tools: receipt_extensions_extraction: complete - tool: apply_profile_adoption module: Tools/apply_profile_adoption.py - source_hash: sha256:d845170185e1b29cbc50565a446cc40e7b8d97ea9184e305cc08ba8861871b3c + source_hash: sha256:a0186cbb61beb0db7de6febda5df0b2bb148ec4e3435549c1c5e72e91aa1ab94 description: Apply one no-runtime R09 Profile adoption (initial adoption or pre-runtime profile revision) from a restricted-YAML plan arguments: - dest: root @@ -785,7 +789,7 @@ tools: nargs: null action: store type: null - help: repository root (no .cambium/ may exist anywhere under it) + help: repository root (no task runtime may exist; governance state may exist) - dest: plan option_strings: - --plan @@ -829,29 +833,10 @@ tools: nargs: null action: store type: null - help: "transaction receipt JSONL destination (default: .receipts.jsonl beside the plan; never .cambium/)" + help: must be the canonical Standards history stream .cambium/receipts/standards-adoptions.jsonl mutually_exclusive_groups: [] receipt_extensions: - - adoption_requirement - - branch - - change_summary - - changed_predicate_ids - identity - - k00_03_sha256_after - - k00_03_sha256_before - - plan_path - - plan_sha256 - - profile_contract_fingerprint_after - - profile_load_gate_id - - profile_load_inputs_sha256_after - - profile_load_receipt_id - - profile_snapshot_sha256_after - - selected_profile_manifest_after - - selected_profile_manifest_before - - standards_effective_date_after - - standards_status_after - - standards_version_after - - standards_version_before - transaction_id receipt_extensions_extraction: complete - tool: apply_task_plan @@ -1100,7 +1085,7 @@ tools: receipt_extensions_extraction: partial - tool: check_boundary_contract module: Tools/check_boundary_contract.py - source_hash: sha256:81450450580a51ff9d53420b6f5dd456dc5fd64a15bb2adabe28f82bc0266640 + source_hash: sha256:988500b4e7992395bbd2d8aed27158ab1e2ec26c07cdb049d04bc1468fce367c description: "Validate page boundary blocks against the K08/09 page boundary contract (gate: boundary-contract; advisory by default)." arguments: - dest: vault_root @@ -1487,7 +1472,7 @@ tools: receipt_extensions_extraction: partial - tool: check_page_contract module: Tools/check_page_contract.py - source_hash: sha256:3696d3b0024a5f2e96dd7012f47ecf91caa430ddafe50c177f8cdfbe1c4c0492 + source_hash: sha256:e2397cfd5950eaf96cc6e565d9e3c1bc3ad071a346b3a82e6c2635e5479f84c4 description: "Validate pages against the compiled frontmatter page contract (gate: page-contract; advisory by default)." arguments: - dest: vault_root @@ -1676,7 +1661,7 @@ tools: receipt_extensions_extraction: complete - tool: check_proof module: Tools/check_proof.py - source_hash: sha256:644a925c631d7fd25cb85b3a62209796e89927b1444de98074a902b8377a1934 + source_hash: sha256:dca5bc6433324a2a90ebedf1ba969ced14da867cc1225d0e478d81f09eb1cb86 description: Terminal Proof completeness and zero-condition check arguments: - dest: proof @@ -1767,7 +1752,7 @@ tools: receipt_extensions_extraction: partial - tool: check_queue module: Tools/check_queue.py - source_hash: sha256:137aeeffc12be70bb699b7a8243c07a95dce6c2bf2a37228b655c3fe44c639ce + source_hash: sha256:5e0db75e6b6d7b209b7764092e3c54f71d02560357d38d5b77118f772c1cc07d description: Validate canonical Required Queue state arguments: - dest: root @@ -2074,7 +2059,7 @@ tools: receipt_extensions_extraction: partial - tool: check_structure module: Tools/check_structure.py - source_hash: sha256:0b5a64dbc630ca2e624d5b73dc96dbf6684420eb1025cf9f9d0f1895ae144b80 + source_hash: sha256:0b0a6ad449bf8fad25d27b6a3f716d590c519d448e13ab2dd62cb51e5737285e description: "Validate the selected profile's Structure Registry against the vault (gate: structure-registry)." arguments: - dest: vault_root @@ -2489,7 +2474,7 @@ tools: receipt_extensions_extraction: partial - tool: compose_page_contract module: Tools/compose_page_contract.py - source_hash: sha256:98b335a9c9d6486ce1b7413a4ba057bb2dade2ca976fb9d0ae506a267d1eee17 + source_hash: sha256:d5bdd1fab7c26126e0139f9940c3808b287de663d585732e286e2a0b1b3a267a description: Compose the effective frontmatter page contract from the kernel bases and the selected profile's Metadata Contract. arguments: - dest: root @@ -2574,7 +2559,7 @@ tools: receipt_extensions_extraction: complete - tool: compose_vocab module: Tools/compose_vocab.py - source_hash: sha256:3ce870bb000813eedf466e11e639e059c7196a5dae33dd7f504541cb91a3f978 + source_hash: sha256:ad43f632d5ccb129dc905de45821583111020e5ab3e6aac3e61dcd404cbdf697 description: Deterministically compose the vocabulary artifact from the kernel base and the selected profile's extensions. arguments: - dest: base @@ -2598,7 +2583,7 @@ tools: nargs: null action: store type: null - help: the active profile's vocabulary-extensions.yaml. K00/03 selects the path; when this flag is present it must name that same path + help: the active profile's vocabulary-extensions.yaml. Canonical adopter Standards state selects the path; when this flag is present it must name that same path - dest: output option_strings: - --output @@ -2688,7 +2673,7 @@ tools: receipt_extensions_extraction: partial - tool: init_state module: Tools/init_state.py - source_hash: sha256:cb8cf12d1442c341d58539f3cd0998f883bebe88fabc7d2b09ae551f818f7e80 + source_hash: sha256:971e2809f737f8fe1d60cde2dfe4ec6bdccbf31818806ec44336c8280574540d description: Initialize empty Cambium runtime state arguments: - dest: root @@ -2755,7 +2740,7 @@ tools: nargs: null action: store type: null - help: Standards version this runtime adopts; must equal the approved standards_version of the active K00/03 Standards Control + help: Standards version this runtime adopts; must equal the approved standards_version of the canonical adopter Standards state - dest: profile_manifest option_strings: - --profile-manifest @@ -2766,7 +2751,7 @@ tools: nargs: null action: store type: null - help: repository-relative selected profile manifest; must equal the selected_profile_manifest of the active K00/03 Standards Control + help: repository-relative selected profile manifest; must equal the selected_profile_manifest of the canonical adopter Standards state - dest: contract_version option_strings: - --contract-version @@ -2890,9 +2875,38 @@ tools: mutually_exclusive_groups: [] receipt_extensions: [] receipt_extensions_extraction: complete + - tool: migrate_standards_state + module: Tools/migrate_standards_state.py + source_hash: sha256:91a6569657b53dce5cb5d8d8fbf437460922425c1cdf03624edb09a4f35184b4 + description: Migrate existing runtime identity to Standards state + arguments: + - dest: root + option_strings: [] + required: true + default: null + default_type: NoneType + choices: null + nargs: null + action: store + type: null + help: adopting repository root + - dest: apply + option_strings: + - --apply + required: false + default: false + default_type: bool + choices: null + nargs: 0 + action: store_true + type: null + help: write state; omit for a dry run + mutually_exclusive_groups: [] + receipt_extensions: [] + receipt_extensions_extraction: complete - tool: profile_onboarding_status module: Tools/profile_onboarding_status.py - source_hash: sha256:cde3d167db14066a1b1325f16666451dc473bc83f88e47927edcce0f7510c6c8 + source_hash: sha256:3cf70ce7b7406cd32ed90a659b34356a4eb247d2659c9ba27307c31531ef822d description: "Read-only onboarding status projector: derives the adoption/onboarding state of one root and exactly one next_action token; writes nothing and owns no ledger" arguments: - dest: root @@ -3599,7 +3613,7 @@ tools: receipt_extensions_extraction: partial - tool: render_boundary_projection module: Tools/render_boundary_projection.py - source_hash: sha256:fc3bff597fafd3babe80e0f32c80df2de406861d679f99b0b3481a326385f48b + source_hash: sha256:e60e7f6744b7c0daff72394eb68f2459056c2bb07559833a700f7a91f77efcbb description: Render the K08/09 boundary projection blocks from page `boundary` frontmatter. arguments: - dest: vault_root @@ -3905,7 +3919,7 @@ tools: receipt_extensions_extraction: complete - tool: render_structure_projection module: Tools/render_structure_projection.py - source_hash: sha256:85ab09f2e199bbf2bd181ba1858e97091e21484f7d98392caa4fe2cf8aee377f + source_hash: sha256:b985e3c17787afc4e3f2dd12f8a01d83f542b2d66c1993134f6c5df11bad8fc1 description: Render derived Structure Registry coverage projections (K01/05 derived roles). arguments: - dest: vault_root @@ -4140,7 +4154,7 @@ tools: receipt_extensions_extraction: complete - tool: stamp_cards module: Tools/stamp_cards.py - source_hash: sha256:2837efc108d6fc15663aa0aa66e9a49c16c6cccf704d34a213492bc8d8122e62 + source_hash: sha256:19fdf534a22f95d93106d86ca73d3fdbf08d65bfc8adb53cc93b3e9ec03f35e5 description: Stamp kernel Runtime Cards arguments: - dest: root diff --git a/Tools/compiled/host-configs/claude-code.mcp.json b/Tools/compiled/host-configs/claude-code.mcp.json index 528984d..6a436d2 100644 --- a/Tools/compiled/host-configs/claude-code.mcp.json +++ b/Tools/compiled/host-configs/claude-code.mcp.json @@ -1 +1 @@ -{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db","CAMBIUM_WORKSPACE_ROOT":""}}}} +{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79","CAMBIUM_WORKSPACE_ROOT":""}}}} diff --git a/Tools/compiled/host-configs/codex.config.toml b/Tools/compiled/host-configs/codex.config.toml index a4a3c8a..9ea7c93 100644 --- a/Tools/compiled/host-configs/codex.config.toml +++ b/Tools/compiled/host-configs/codex.config.toml @@ -5,7 +5,7 @@ # server name: cambium # server entry point: Tools/mcp_server.py (under the distribution root) # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db +# source_hash: sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79 # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # @@ -35,5 +35,5 @@ command = "python3" cwd = "" [mcp_servers.cambium.env] -CAMBIUM_INTERFACE_SOURCE_HASH = "sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db" +CAMBIUM_INTERFACE_SOURCE_HASH = "sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79" CAMBIUM_WORKSPACE_ROOT = "" diff --git a/Tools/compiled/host-configs/dsh-profile-patch.yaml b/Tools/compiled/host-configs/dsh-profile-patch.yaml index 974df86..b0aee84 100644 --- a/Tools/compiled/host-configs/dsh-profile-patch.yaml +++ b/Tools/compiled/host-configs/dsh-profile-patch.yaml @@ -5,7 +5,7 @@ # server name: cambium # server entry point: Tools/mcp_server.py (under the distribution root) # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db +# source_hash: sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79 # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # diff --git a/Tools/compiled/host-configs/dsh.env b/Tools/compiled/host-configs/dsh.env index 63d90ba..935e9eb 100644 --- a/Tools/compiled/host-configs/dsh.env +++ b/Tools/compiled/host-configs/dsh.env @@ -4,7 +4,7 @@ # carries: binding # server name: cambium # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db +# source_hash: sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79 # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # @@ -21,5 +21,5 @@ # valid absolute path on any of these hosts, so an un-substituted copy # fails at launch instead of resolving to something. -CAMBIUM_INTERFACE_SOURCE_HASH="sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db" +CAMBIUM_INTERFACE_SOURCE_HASH="sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79" CAMBIUM_WORKSPACE_ROOT="" diff --git a/Tools/compiled/host-configs/kimi-code.mcp.json b/Tools/compiled/host-configs/kimi-code.mcp.json index 528984d..6a436d2 100644 --- a/Tools/compiled/host-configs/kimi-code.mcp.json +++ b/Tools/compiled/host-configs/kimi-code.mcp.json @@ -1 +1 @@ -{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:8a6dc2c0e50f1f716b31470624c232d44a089d0c1884f8cc3a6b1dc3044ce8db","CAMBIUM_WORKSPACE_ROOT":""}}}} +{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79","CAMBIUM_WORKSPACE_ROOT":""}}}} diff --git a/Tools/compiled/mcp-tools.json b/Tools/compiled/mcp-tools.json index d03e8c0..e422007 100644 --- a/Tools/compiled/mcp-tools.json +++ b/Tools/compiled/mcp-tools.json @@ -1 +1 @@ -{"artifact":"agent-interface-projection","form":"mcp","generated":{"not_a_revision_basis":"This file is downstream of each tool's own argparse declaration and is never the basis for revising one. To change what an agent may call, change the tool's argparse block, recompile Tools/compiled/cli-contract.yaml, then regenerate this file.","notice":"Generated artifact -- do not edit. Every value here is projected from Tools/compiled/cli-contract.yaml by Tools/render_interface_projection.py; a hand edit is reported by --check as a HOLD.","regenerate":"python3 Tools/render_interface_projection.py .","verify":"python3 Tools/render_interface_projection.py . --check"},"generator":"Tools/render_interface_projection.py","generator_version":"1.0.0","schema_version":1,"source":"Tools/compiled/cli-contract.yaml","source_artifact":"cli-invocation-contract","source_hash":"sha256:cc99ee0f1ccf61190350aa47d4a6173f654cb17b73b7507416aebbf8e2803187","source_manifest_hash":"sha256:0851f552ac8080f96d888a5a236abf93aa1b7af5fa541b1bf6e62dfe690a23f6","source_schema_version":1,"tool_count":45,"tools":[{"description":"Adopt one approved Standards/Profile revision","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Standards adoption","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/standards-adoptions/*.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/standards-adoptions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"adopt_standards"},{"description":"Apply one approved cross-Ledger Amendment transaction","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply an Amendment transaction","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"apply_amendment"},{"description":"Amend the frozen Task Contract from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a contract amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/contract-amendments","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/contract-amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_contract_amendment"},{"description":"Deterministic Coverage Delta application","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply canonical Coverage","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the merged Coverage; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"delta":{"description":"batch Coverage delta to apply; canonical mode requires exactly .cambium/deltas/.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"expected_coverage_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Coverage; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"force":{"default":false,"description":"legacy mode only: keep pages whose ledger batch/next_batch does not match the delta batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--force"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage ledger to merge into; canonical mode requires exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"preflight":{"default":false,"description":"plan canonical Coverage and routed-gap settlement without writes; allows an open batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--preflight"]}},"receipts":{"description":"receipt JSONL destination; canonical mode defaults to a new .cambium/receipts/.jsonl and refuses an existing path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root (canonical mode)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["ledger","delta"],"type":"object"},"name":"apply_delta","x-cambium-mutually-exclusive":[{"dests":["apply","preflight"],"required":false}]},{"description":"Apply one receipt-backed Profile metadata transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"commit owner state and page projection","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"Coverage fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_page_sha256":{"description":"target page fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-page-sha256"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"gate_receipt":{"description":"current producer receipt ID for this Gate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"description":"fresh JSONL path under .cambium/receipts; default is .jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","gate_receipt"],"type":"object"},"name":"apply_metadata_transition"},{"description":"Apply one no-runtime R09 Profile adoption (initial adoption or pre-runtime profile revision) from a restricted-YAML plan","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"perform the transaction; without it the complete planned change is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"root-relative adoption plan (schemas/profile_adoption_plan.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"description":"transaction receipt JSONL destination (default: .receipts.jsonl beside the plan; never .cambium/)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"repository root (no .cambium/ may exist anywhere under it)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_profile_adoption"},{"description":"Materialize a task runtime from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/task-plans","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/task-plans.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_task_plan"},{"description":"Run and publish the K12/09 batch-close evidence bundle","inputSchema":{"additionalProperties":false,"properties":{"accept_candidate_id":{"default":[],"description":"accept this exact current candidate for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-id"]}},"accept_candidate_type":{"default":[],"description":"accept every current candidate of this exact tool:check type for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-type"]}},"accept_while_unchanged_id":{"default":[],"description":"accept this exact current candidate and permit reuse while its observation is unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-id"]}},"accept_while_unchanged_type":{"default":[],"description":"expand this current exact type set and permit those rows to be reused while unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-type"]}},"batch":{"description":"merge-ready batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"integrator":{"description":"declared integrator label recorded in the evidence","type":"string","x-cambium-cli":{"action":"store","option_strings":["--integrator"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/batch-close.jsonl","description":"repository-relative close evidence JSONL","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"review_attestation":{"description":"reviewer's explicit global-review statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--review-attestation"]}},"reviewer":{"description":"declared reviewer label (must differ from integrator)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","batch","integrator","reviewer","review_attestation"],"type":"object"},"name":"check_batch_close"},{"description":"Validate page boundary blocks against the K08/09 page boundary contract (gate: boundary-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures except the B4 migration-tolerated case; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_boundary_contract"},{"description":"Validate explicit Corpus Planning artifacts","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write only the deterministic normalized result JSON to stdout","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"repository-relative Profile manifest or Profile directory; default: selected Profile in Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"append JSONL receipts here","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_corpus_plan"},{"description":"Closed-world freshness / review_by candidate check","inputSchema":{"additionalProperties":false,"properties":{"as_of":{"description":"reference date YYYY-MM-DD for overdue computation (default: today)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--as-of"]}},"defaults":{"description":"optional domain -> volatility mapping file (restricted YAML subset); an active page with no explicit or defaulted volatility is a candidate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"exclude":{"default":[],"description":"skip files whose path contains this component (repeatable; default: none)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_freshness"},{"description":"Wiki link missing/ambiguous/heading check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); files whose path contains the component are neither scanned for outgoing links nor used in basename disambiguation, but exact full-path links into them still resolve (excluded means not audited, not nonexistent)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (the index still covers the whole vault)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_links"},{"description":"MOC Module Index consistency candidate detection","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); no semantic directory name is excluded by default","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append a machine-readable receipt to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"scan root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_moc"},{"description":"Validate pages against the compiled frontmatter page contract (gate: page-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_page_contract"},{"description":"Profile manifest completeness and unfilled-template check","inputSchema":{"additionalProperties":false,"properties":{"defaults":{"description":"machine-readable profile-form placeholder registry (default: Tools/schemas/execution_defaults.template.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"execution_defaults":{"description":"kernel execution-default override registry (default: kernel/K00 Standards Control/execution-defaults-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--execution-defaults"]}},"interface":{"description":"normative slot interface file (default: profiles/README.md under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--interface"]}},"json":{"default":false,"description":"write one deterministic JSON object (tool, root, result, findings each carrying a closed mechanical/semantic-unresolved category) to stdout instead of the human summary; receipts and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_dir":{"description":"the profile directory to check (e.g. profiles/)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"default":".","description":"vault root that vault-relative bindings resolve against (default: this script's repository root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["profile_dir"],"type":"object"},"name":"check_profile"},{"description":"Terminal Proof completeness and zero-condition check","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage Ledger YAML; with --root this must be exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger"]}},"progress_ledger":{"description":"Progress Ledger YAML; required with --root and must be exactly .cambium/state/progress_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--progress-ledger"]}},"proof":{"description":"path to the terminal proof YAML file","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"vault root; when given, path-valued proof fields must exist and selected routes, Cards, and kernel Read Sets must agree with the canonical route indexes","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"template":{"default":"Tools/schemas/terminal_proof.template.yaml","description":"field-list template (default Tools/schemas/terminal_proof.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--template"]}}},"required":["proof"],"type":"object"},"name":"check_proof"},{"description":"Validate canonical Required Queue state","inputSchema":{"additionalProperties":false,"properties":{"boundary_gate_receipt":{"default":[],"description":"current gate evidence supplied to --require-revalidation","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--boundary-gate-receipt"]}},"budget_manifest_receipt":{"description":"closed budget-manifest receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--budget-manifest-receipt"]}},"confirmation_receipt":{"description":"confirmation evidence supplied to --require-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"deliver_readback":{"description":"deliver one registered conditional Card read-back source for an already-open batch","type":"string","x-cambium-cli":{"action":"store","option_strings":["--deliver-readback"]}},"json":{"default":false,"description":"write this run's receipt object to stdout as one canonical JSON array and move the human report to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger_advance_receipt":{"description":"Coverage Ledger advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger-advance-receipt"]}},"readback_rule":{"description":"registered rule selected with --deliver-readback","type":"string","x-cambium-cli":{"action":"store","option_strings":["--readback-rule"]}},"receipts":{"description":"repository-relative JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"require_complete":{"default":false,"description":"build completion gate: prove no Required work remains","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-complete"]}},"require_maintenance_complete":{"default":false,"description":"maintenance completion gate: prove one bounded maintenance run is complete","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-maintenance-complete"]}},"require_ready":{"description":"prove BATCH_ID is queued and ready to activate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-ready"]}},"require_revalidation":{"description":"prove BATCH_ID may produce its Standards revalidation aggregate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-revalidation"]}},"resume_status":{"default":false,"description":"show interruption-safe task and batch resume state","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--resume-status"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"watermark_advance_receipt":{"description":"watermark advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--watermark-advance-receipt"]}}},"required":["root"],"type":"object"},"name":"check_queue","x-cambium-mutually-exclusive":[{"dests":["require_ready","require_revalidation","require_complete","require_maintenance_complete","resume_status","deliver_readback"],"required":false}]},{"description":"Find profile-configured residual content outside accepted roots.","inputSchema":{"additionalProperties":false,"properties":{"config":{"description":"profile-owned restricted YAML scan configuration","type":"string","x-cambium-cli":{"action":"store","option_strings":["--config"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"positive_controls_only":{"default":false,"description":"execute the registered controls through the production classifier without scanning repository content","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--positive-controls-only"]}},"receipts":{"description":"optional JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scan_id":{"description":"stable ID from the selected profile's scan registry","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scan-id"]}},"time_limit":{"default":55.0,"description":"hard evidence-production budget in seconds (greater than 0 and at most 55)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--time-limit"],"type":"float"}},"vault_root":{"description":"knowledge-vault root to scan","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root","scan_id","config"],"type":"object"},"name":"check_residual_content"},{"description":"Validate the selected profile's Structure Registry against the vault (gate: structure-registry).","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_structure"},{"description":"Frontmatter controlled-vocabulary check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"subpath to exclude (repeatable; e.g. the compiled kernel/Cards artifacts, whose frontmatter is not governed by the K08 module's knowledge-page schema)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"policy_fingerprint":{"description":"effective-policy fingerprint (kblib.effective_priority_policy) the quotas were resolved from; recorded on the priority-quota-compliance receipt so its consumers can bind the policy identity, never re-derive it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--policy-fingerprint"]}},"quota_p0":{"default":15.0,"description":"P0 priority quota in percent (default 15; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p0"],"type":"float"}},"quota_p1":{"default":35.0,"description":"P1 priority quota in percent (default 35; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p1"],"type":"float"}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"vocab":{"description":"path to vocab.yaml (defaults to vocab.yaml next to this script)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--vocab"]}}},"required":["vault_root"],"type":"object"},"name":"check_vocab"},{"description":"Compile the machine-readable CLI invocation contract from every Tools/*.py argparse declaration.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 when it is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"artifact path to write or verify (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root whose Tools/ directory is compiled","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_cli_contract"},{"description":"Compile Required Queue from explicit Coverage assignments","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Queue write or replan","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"registered Amendment id authorizing the replan; required with --apply-replan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"materialize an initially empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"apply_replan":{"default":false,"description":"apply a controlled structural diff to a non-empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply-replan"]}},"coverage_proposal":{"description":"repository-contained .cambium/deltas/replans/*.coverage.yaml input","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_revision":{"description":"compare-and-swap guard: the queue_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-revision"],"type":"int"}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the replan is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"output":{"description":"repository-relative proposal path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"receipts":{"default":".cambium/receipts/queue-structure.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"replan_diff":{"description":"existing .cambium/tmp/*.yaml diff to consume","type":"string","x-cambium-cli":{"action":"store","option_strings":["--replan-diff"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_queue","x-cambium-mutually-exclusive":[{"dests":["apply","apply_replan"],"required":false}]},{"description":"Compose the effective frontmatter page contract from the kernel bases and the selected profile's Metadata Contract.","inputSchema":{"additionalProperties":false,"properties":{"base":{"description":"applicability base to compile from (default: kernel/K08 Metadata and Status/applicability-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"compiled page contract to write, or to compare against under --check (default: Tools/page_contract.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"profile":{"description":"profile directory for a validation run; the vault selection stays with K00/03","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"relationships":{"description":"relationship base to compile from (default: kernel/K08 Metadata and Status/relationship-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--relationships"]}},"root":{"default":".","description":"vault root (default: this repository)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"sources_role":{"description":"sources-role base to compile from (default: kernel/K07 Sources and Accuracy/sources-role-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--sources-role"]}}},"type":"object"},"name":"compose_page_contract"},{"description":"Deterministically compose the vocabulary artifact from the kernel base and the selected profile's extensions.","inputSchema":{"additionalProperties":false,"properties":{"base":{"default":"kernel/K08 Metadata and Status/vocabulary-base.yaml","description":"the kernel vocabulary base the extensions are appended to (default: kernel/K08 Metadata and Status/vocabulary-base.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when values and provenance are identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"extensions":{"description":"the active profile's vocabulary-extensions.yaml. K00/03 selects the path; when this flag is present it must name that same path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--extensions"]}},"output":{"default":"Tools/vocab.yaml","description":"composed vocabulary artifact to write, or to compare against under --check (default: Tools/vocab.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}}},"type":"object"},"name":"compose_vocab"},{"description":"Cross-file duplicate paragraph candidate detection (for maintenance runs and governance tasks)","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"description":"skip files whose path contains this component (repeatable; default: legacy)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to (shared convention, Tools/schemas/receipt.template.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"subpath (relative to vault, or absolute): only report similar pairs with at least one side under it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault":{"default":".","description":"vault root directory (default: current directory)","type":"string","x-cambium-cli":{"action":"store","nargs":"?","option_strings":[]}}},"type":"object"},"name":"duplicate_check"},{"description":"Initialize empty Cambium runtime state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"materialize .cambium/; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"initial Coverage timestamp (default: current UTC)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"completion_semantics":{"description":"build requires completion-candidate plus Terminal Proof; maintenance closes directly through the bounded maintenance completion gate","enum":["build","maintenance"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--completion-semantics"]}},"concurrency_cap":{"description":"explicit task-contract override of K13/10's concurrency cap; omit it to take the selected profile manifest's registered override, or the kernel default 3 when the manifest registers none","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--concurrency-cap"],"type":"int"}},"contract_version":{"default":"c1","description":"non-empty task-contract version recorded on the Progress Ledger contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract-version"]}},"exclusions":{"default":[],"description":"explicit out-of-scope item; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"objective":{"description":"non-empty statement of the task outcome","type":"string","x-cambium-cli":{"action":"store","option_strings":["--objective"]}},"profile_manifest":{"description":"repository-relative selected profile manifest; must equal the selected_profile_manifest of the active K00/03 Standards Control","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-manifest"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"scope_version":{"description":"non-empty scope identity stamped on the Queue, Coverage Ledger and task contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope-version"]}},"standards_version":{"description":"Standards version this runtime adopts; must equal the approved standards_version of the active K00/03 Standards Control","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-version"]}},"task_id":{"description":"non-empty task identity stamped on the Queue, Coverage Ledger and Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--task-id"]}}},"required":["root","task_id","objective","scope_version","standards_version","profile_manifest","completion_semantics"],"type":"object"},"name":"init_state"},{"description":"Compile and load Cambium's closed metadata-execution authority contract. This module is deliberately the single authority boundary between metadata declarations and executable writers. A field rule is executable only when an installed writer capability declares the same ``(field, transition, adapter)`` operation, and every installed writer operation must be authorized by exactly one rule. Unknown keys, unknown adapters, orphan implementations, and partial evidence bindings fail closed.","inputSchema":{"additionalProperties":false,"properties":{"authority":{"default":"kernel/K08 Metadata and Status/metadata-authority-base.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--authority"]}},"capabilities":{"default":"Tools/operation-capabilities.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--capabilities"]}},"check":{"default":false,"type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":"Tools/compiled/metadata-execution-contract.json","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"default":".","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"type":"object"},"name":"metadata_execution_contract"},{"description":"Read-only onboarding status projector: derives the adoption/onboarding state of one root and exactly one next_action token; writes nothing and owns no ledger","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"emit the status view as one deterministic JSON object instead of the human summary","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"target one candidate profile directory name under profiles/ for the full profile-load evaluation (defaults to the single candidate when exactly one exists)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"the adopting repository root to project","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"profile_onboarding_status"},{"description":"Project metadata-contract owner state onto page frontmatter","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"take the runtime writer lock and publish the projection; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"page":{"description":"limit to these repository-relative pages (repeatable); default is every Ledger page","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--page"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"project_page_state"},{"description":"Record one snapshot-bound Batch Review judgment","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"batch":{"description":"exact open Queue batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"judgment_item":{"description":"registered Batch Review Requirement Judgment Item ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--judgment-item"]}},"receipts":{"default":".cambium/receipts/batch-judgments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reviewer_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer-role"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded judgment statement (the concrete verdict, not \"reviewed\")","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"target":{"description":"manifest page path, or the batch ID for a batch-selector requirement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--target"]}}},"required":["root","batch","judgment_item","target","reviewer_role","statement"],"type":"object"},"name":"record_batch_judgment"},{"description":"Record a Profile-authorized Corpus Planning semantic decision as machine-readable JSONL","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared authority Role ID; required with --apply and must equal the Profile/plan binding","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the structural and semantic receipts; default is dry-run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"plan":{"description":"closed restricted-YAML acceptance decision plan; one .yaml file directly under .cambium/deltas/corpus-plan-acceptances/","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/corpus-plan-acceptance.jsonl","description":"repository-relative JSONL path the receipts are appended to (default: .cambium/receipts/corpus-plan-acceptance.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"record_corpus_acceptance"},{"description":"Record snapshot-bound manual Extension Gate evidence","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-attestations.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded manual attestation statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","actor_role","statement"],"type":"object"},"name":"record_gate_attestation"},{"description":"Run a registered scan and record a deterministic Extension Gate result","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"run and append the bound Gate result","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact deterministic typed Profile Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-results.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","gate_id","page"],"type":"object"},"name":"record_gate_result"},{"description":"Register one approved current-protocol Amendment","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may register or withdraw an Amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"id for a queue-replan registration; cross-Ledger operations derive it from --plan instead","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"write the registration; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"approval_reference":{"description":"explicit-user approval reference; required when --decision-mode is explicit-user","type":"string","x-cambium-cli":{"action":"store","option_strings":["--approval-reference"]}},"coverage_proposal":{"description":".cambium/deltas/replans/*.coverage.yaml proposal","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"date":{"description":"YYYY-MM-DD; must equal the UTC registration date","type":"string","x-cambium-cli":{"action":"store","option_strings":["--date"]}},"decision_mode":{"default":"auto","description":"derive delegated authority by default; explicit-user requires --approval-reference","enum":["auto","contract-delegated","explicit-user"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--decision-mode"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the published receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"operation":{"description":"Amendment operation being registered","enum":["cancel-batch","gap-routing-reconciliation","property-state-migration","queue-replan","scope-replan"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--operation"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"reason":{"description":"nonempty withdrawal reason recorded on the row and its receipt","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"summary":{"description":"non-empty one-line rationale recorded on the row","type":"string","x-cambium-cli":{"action":"store","option_strings":["--summary"]}},"withdraw":{"description":"retire the named pending registration instead of registering one (K13/06 withdrawal); requires --reason","type":"string","x-cambium-cli":{"action":"store","option_strings":["--withdraw"]}}},"required":["root","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"register_amendment"},{"description":"Render the K08/09 boundary projection blocks from page `boundary` frontmatter.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_boundary_projection"},{"description":"Render the Cambium MCP server's registration and corpus binding into the configuration file each supported host reads.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"re-render and compare against the existing products; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"distribution_root":{"description":"absolute path of the Cambium checkout the server is launched from; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--distribution-root"]}},"host":{"description":"render only this host's product (default: every host)","enum":["claude-code","codex","dsh-env","dsh-profile-patch","kimi-code"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--host"]}},"output_dir":{"description":"directory to write or verify the products in (default: /Tools/compiled/host-configs)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output-dir"]}},"projection":{"description":"compiled interface projection to bind to (default: /Tools/compiled/mcp-tools.json)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--projection"]}},"root":{"description":"repository root holding the compiled interface projection","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every rendered field and exit without reading or writing any product","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}},"workspace_root":{"description":"absolute path of the corpus repository this registration is bound to; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--workspace-root"]}}},"required":["root"],"type":"object"},"name":"render_host_configs","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Project the compiled CLI invocation contract into the agent-facing interface forms registered in this tool.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing artifacts; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"description":"compiled CLI contract to project (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"form":{"description":"project only this form (default: every registered form)","enum":["mcp"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--form"]}},"output":{"description":"artifact path to write or verify; requires --form, because one path cannot hold two forms","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root holding the compiled CLI contract","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every projected field and exit without reading or writing any artifact","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}}},"required":["root"],"type":"object"},"name":"render_interface_projection","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Render Required Queue human report","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"compare existing report instead of writing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":".cambium/reports/required_queue.md","description":"repository-relative report path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"stdout":{"default":false,"description":"print the report to stdout and write nothing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--stdout"]}}},"required":["root"],"type":"object"},"name":"render_queue"},{"description":"Render derived Structure Registry coverage projections (K01/05 derived roles).","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale or missing; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_structure_projection"},{"description":"Run the adopter verification set derived from the K00/12 Stable Gate ID Registry (deterministic, not-batch-scoped producers).","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path prefix passed through to scanners that accept it (repeatable)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"list":{"default":false,"description":"print the derived set and each command without running anything","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--list"]}},"profile":{"description":"profile directory override; default is the live runtime's selected_profile_manifest","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"run_gates"},{"description":"Scaffold a candidate profile from profiles/_template using the exact-copy whitelist in profiles/template-files.yaml","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"create the candidate; without it the plan is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"candidate profile slug matching [a-z0-9][a-z0-9_-]* (equals the directory name)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"repository root containing profiles/","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","profile_id"],"type":"object"},"name":"scaffold_profile"},{"description":"Seal verified frozen receipt history (K12/07). --apply is a maintenance-window operation: run it only with no other Cambium or adopter writer, checker or receipt appender active against this repository.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the seal, or with --reconcile finish the interrupted one; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/seal-receipts.jsonl","description":"repository-relative JSONL path for this tool's own seal receipts, which never seal (default: .cambium/receipts/seal-receipts.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reconcile":{"default":false,"description":"finish an interrupted seal over the publication paths this tool implements; other interruptions fail closed and are resolved by the runbook in Tools/README.md","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--reconcile"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"verify":{"default":false,"description":"re-prove every sealed segment, projection and seal-receipt binding, then exit","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--verify"]}}},"required":["root"],"type":"object"},"name":"seal_receipts"},{"description":"Stamp kernel Runtime Cards","inputSchema":{"additionalProperties":false,"properties":{"acknowledge_compiled":{"default":false,"description":"after semantic regeneration/review, advance compiled_source_hash to the exact current source digest","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--acknowledge-compiled"]}},"cards_dir":{"default":"kernel/Cards","description":"Card directory relative to (default: kernel/Cards)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--cards-dir"]}},"check":{"default":false,"description":"verify only; never write","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"set_version":{"description":"also set every card's compiled_from value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--set-version"]}}},"required":["root"],"type":"object"},"name":"stamp_cards"},{"description":"Apply one Required Queue transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; Queue transition planning and apply both require integrator","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"batch_receipt":{"default":[],"description":"batch-review gate receipt id for open -> merge-ready; exactly one is accepted","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--batch-receipt"]}},"close_gate_receipt":{"description":"check_batch_close receipt id required by the closed transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--close-gate-receipt"]}},"confirmation_receipt":{"description":"confirmation receipt id required by queued -> open when the batch is confirmation_required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"delta_apply_receipt":{"description":"apply_delta receipt id required by the closed transition and by merge-ready -> open reopen","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-apply-receipt"]}},"delta_path":{"description":"repository-relative .cambium/deltas/.yaml batch delta required by open -> merge-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-path"]}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"gate_receipt":{"description":"gate receipt id: activation gate for queued -> open, Queue consistency gate for closed and for clearing revalidation-required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"hold_state":{"description":"target hold state; exclusive with --transition","enum":["blocked","confirmation-required","none","paused","revalidation-required"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--hold-state"]}},"id":{"description":"Required Queue batch id to transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--id"]}},"json":{"default":false,"description":"write the applied transition receipt(s) to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"reason":{"description":"non-empty rationale required by merge-ready -> open and by any non-none hold","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/queue-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"standards_revalidation_receipt":{"description":"check_queue --require-revalidation receipt discharging an outstanding Standards revalidation; queued -> open or revalidation-required -> none only","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-revalidation-receipt"]}},"transition":{"description":"target lifecycle state; exclusive with --hold-state","enum":["closed","merge-ready","open"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","id"],"type":"object"},"name":"update_queue","x-cambium-mutually-exclusive":[{"dests":["transition","hold_state"],"required":true}]},{"description":"Apply one canonical task-state transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a task-state write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"checkpoint_summary":{"description":"non-empty reason required by paused, blocked and cancelled, and when leaving completion-candidate for anything but complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--checkpoint-summary"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the applied transition receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"maintenance_completion_receipt":{"description":"maintenance completion gate receipt id required by complete under maintenance completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--maintenance-completion-receipt"]}},"queue_check_receipt":{"description":"Queue completion gate receipt id required by the completion-candidate transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--queue-check-receipt"]}},"receipts":{"default":".cambium/receipts/task-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"terminal_proof_receipt":{"description":"Terminal Proof receipt id required by complete under build completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--terminal-proof-receipt"]}},"transition":{"description":"target task state in the Progress Ledger","enum":["active","blocked","cancelled","complete","completion-candidate","paused"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","transition"],"type":"object"},"name":"update_task"}],"transports":["stdio","streamable-http"]} +{"artifact":"agent-interface-projection","form":"mcp","generated":{"not_a_revision_basis":"This file is downstream of each tool's own argparse declaration and is never the basis for revising one. To change what an agent may call, change the tool's argparse block, recompile Tools/compiled/cli-contract.yaml, then regenerate this file.","notice":"Generated artifact -- do not edit. Every value here is projected from Tools/compiled/cli-contract.yaml by Tools/render_interface_projection.py; a hand edit is reported by --check as a HOLD.","regenerate":"python3 Tools/render_interface_projection.py .","verify":"python3 Tools/render_interface_projection.py . --check"},"generator":"Tools/render_interface_projection.py","generator_version":"1.0.0","schema_version":1,"source":"Tools/compiled/cli-contract.yaml","source_artifact":"cli-invocation-contract","source_hash":"sha256:2acd612e70e4abe5103aa7d081ad60a87f1e5a857cb46aecaaadce12125fc86b","source_manifest_hash":"sha256:f7a5a074561a1740ba5e08dd717c82558da549743c9f2aa5ccfd689120c7cc2c","source_schema_version":1,"tool_count":46,"tools":[{"description":"Adopt one approved Standards/Profile revision","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Standards adoption","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/standards-adoptions/*.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/standards-adoptions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"adopt_standards"},{"description":"Apply one approved cross-Ledger Amendment transaction","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply an Amendment transaction","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"apply_amendment"},{"description":"Amend the frozen Task Contract from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a contract amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/contract-amendments","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/contract-amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_contract_amendment"},{"description":"Deterministic Coverage Delta application","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply canonical Coverage","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the merged Coverage; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"delta":{"description":"batch Coverage delta to apply; canonical mode requires exactly .cambium/deltas/.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"expected_coverage_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Coverage; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"force":{"default":false,"description":"legacy mode only: keep pages whose ledger batch/next_batch does not match the delta batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--force"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage ledger to merge into; canonical mode requires exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"preflight":{"default":false,"description":"plan canonical Coverage and routed-gap settlement without writes; allows an open batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--preflight"]}},"receipts":{"description":"receipt JSONL destination; canonical mode defaults to a new .cambium/receipts/.jsonl and refuses an existing path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root (canonical mode)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["ledger","delta"],"type":"object"},"name":"apply_delta","x-cambium-mutually-exclusive":[{"dests":["apply","preflight"],"required":false}]},{"description":"Apply one receipt-backed Profile metadata transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"commit owner state and page projection","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"Coverage fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_page_sha256":{"description":"target page fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-page-sha256"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"gate_receipt":{"description":"current producer receipt ID for this Gate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"description":"fresh JSONL path under .cambium/receipts; default is .jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","gate_receipt"],"type":"object"},"name":"apply_metadata_transition"},{"description":"Apply one no-runtime R09 Profile adoption (initial adoption or pre-runtime profile revision) from a restricted-YAML plan","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"perform the transaction; without it the complete planned change is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"root-relative adoption plan (schemas/profile_adoption_plan.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"description":"must be the canonical Standards history stream .cambium/receipts/standards-adoptions.jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"repository root (no task runtime may exist; governance state may exist)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_profile_adoption"},{"description":"Materialize a task runtime from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/task-plans","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/task-plans.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_task_plan"},{"description":"Run and publish the K12/09 batch-close evidence bundle","inputSchema":{"additionalProperties":false,"properties":{"accept_candidate_id":{"default":[],"description":"accept this exact current candidate for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-id"]}},"accept_candidate_type":{"default":[],"description":"accept every current candidate of this exact tool:check type for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-type"]}},"accept_while_unchanged_id":{"default":[],"description":"accept this exact current candidate and permit reuse while its observation is unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-id"]}},"accept_while_unchanged_type":{"default":[],"description":"expand this current exact type set and permit those rows to be reused while unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-type"]}},"batch":{"description":"merge-ready batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"integrator":{"description":"declared integrator label recorded in the evidence","type":"string","x-cambium-cli":{"action":"store","option_strings":["--integrator"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/batch-close.jsonl","description":"repository-relative close evidence JSONL","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"review_attestation":{"description":"reviewer's explicit global-review statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--review-attestation"]}},"reviewer":{"description":"declared reviewer label (must differ from integrator)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","batch","integrator","reviewer","review_attestation"],"type":"object"},"name":"check_batch_close"},{"description":"Validate page boundary blocks against the K08/09 page boundary contract (gate: boundary-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures except the B4 migration-tolerated case; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_boundary_contract"},{"description":"Validate explicit Corpus Planning artifacts","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write only the deterministic normalized result JSON to stdout","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"repository-relative Profile manifest or Profile directory; default: selected Profile in Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"append JSONL receipts here","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_corpus_plan"},{"description":"Closed-world freshness / review_by candidate check","inputSchema":{"additionalProperties":false,"properties":{"as_of":{"description":"reference date YYYY-MM-DD for overdue computation (default: today)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--as-of"]}},"defaults":{"description":"optional domain -> volatility mapping file (restricted YAML subset); an active page with no explicit or defaulted volatility is a candidate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"exclude":{"default":[],"description":"skip files whose path contains this component (repeatable; default: none)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_freshness"},{"description":"Wiki link missing/ambiguous/heading check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); files whose path contains the component are neither scanned for outgoing links nor used in basename disambiguation, but exact full-path links into them still resolve (excluded means not audited, not nonexistent)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (the index still covers the whole vault)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_links"},{"description":"MOC Module Index consistency candidate detection","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); no semantic directory name is excluded by default","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append a machine-readable receipt to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"scan root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_moc"},{"description":"Validate pages against the compiled frontmatter page contract (gate: page-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_page_contract"},{"description":"Profile manifest completeness and unfilled-template check","inputSchema":{"additionalProperties":false,"properties":{"defaults":{"description":"machine-readable profile-form placeholder registry (default: Tools/schemas/execution_defaults.template.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"execution_defaults":{"description":"kernel execution-default override registry (default: kernel/K00 Standards Control/execution-defaults-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--execution-defaults"]}},"interface":{"description":"normative slot interface file (default: profiles/README.md under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--interface"]}},"json":{"default":false,"description":"write one deterministic JSON object (tool, root, result, findings each carrying a closed mechanical/semantic-unresolved category) to stdout instead of the human summary; receipts and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_dir":{"description":"the profile directory to check (e.g. profiles/)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"default":".","description":"vault root that vault-relative bindings resolve against (default: this script's repository root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["profile_dir"],"type":"object"},"name":"check_profile"},{"description":"Terminal Proof completeness and zero-condition check","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage Ledger YAML; with --root this must be exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger"]}},"progress_ledger":{"description":"Progress Ledger YAML; required with --root and must be exactly .cambium/state/progress_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--progress-ledger"]}},"proof":{"description":"path to the terminal proof YAML file","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"vault root; when given, path-valued proof fields must exist and selected routes, Cards, and kernel Read Sets must agree with the canonical route indexes","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"template":{"default":"Tools/schemas/terminal_proof.template.yaml","description":"field-list template (default Tools/schemas/terminal_proof.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--template"]}}},"required":["proof"],"type":"object"},"name":"check_proof"},{"description":"Validate canonical Required Queue state","inputSchema":{"additionalProperties":false,"properties":{"boundary_gate_receipt":{"default":[],"description":"current gate evidence supplied to --require-revalidation","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--boundary-gate-receipt"]}},"budget_manifest_receipt":{"description":"closed budget-manifest receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--budget-manifest-receipt"]}},"confirmation_receipt":{"description":"confirmation evidence supplied to --require-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"deliver_readback":{"description":"deliver one registered conditional Card read-back source for an already-open batch","type":"string","x-cambium-cli":{"action":"store","option_strings":["--deliver-readback"]}},"json":{"default":false,"description":"write this run's receipt object to stdout as one canonical JSON array and move the human report to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger_advance_receipt":{"description":"Coverage Ledger advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger-advance-receipt"]}},"readback_rule":{"description":"registered rule selected with --deliver-readback","type":"string","x-cambium-cli":{"action":"store","option_strings":["--readback-rule"]}},"receipts":{"description":"repository-relative JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"require_complete":{"default":false,"description":"build completion gate: prove no Required work remains","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-complete"]}},"require_maintenance_complete":{"default":false,"description":"maintenance completion gate: prove one bounded maintenance run is complete","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-maintenance-complete"]}},"require_ready":{"description":"prove BATCH_ID is queued and ready to activate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-ready"]}},"require_revalidation":{"description":"prove BATCH_ID may produce its Standards revalidation aggregate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-revalidation"]}},"resume_status":{"default":false,"description":"show interruption-safe task and batch resume state","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--resume-status"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"watermark_advance_receipt":{"description":"watermark advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--watermark-advance-receipt"]}}},"required":["root"],"type":"object"},"name":"check_queue","x-cambium-mutually-exclusive":[{"dests":["require_ready","require_revalidation","require_complete","require_maintenance_complete","resume_status","deliver_readback"],"required":false}]},{"description":"Find profile-configured residual content outside accepted roots.","inputSchema":{"additionalProperties":false,"properties":{"config":{"description":"profile-owned restricted YAML scan configuration","type":"string","x-cambium-cli":{"action":"store","option_strings":["--config"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"positive_controls_only":{"default":false,"description":"execute the registered controls through the production classifier without scanning repository content","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--positive-controls-only"]}},"receipts":{"description":"optional JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scan_id":{"description":"stable ID from the selected profile's scan registry","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scan-id"]}},"time_limit":{"default":55.0,"description":"hard evidence-production budget in seconds (greater than 0 and at most 55)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--time-limit"],"type":"float"}},"vault_root":{"description":"knowledge-vault root to scan","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root","scan_id","config"],"type":"object"},"name":"check_residual_content"},{"description":"Validate the selected profile's Structure Registry against the vault (gate: structure-registry).","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_structure"},{"description":"Frontmatter controlled-vocabulary check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"subpath to exclude (repeatable; e.g. the compiled kernel/Cards artifacts, whose frontmatter is not governed by the K08 module's knowledge-page schema)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"policy_fingerprint":{"description":"effective-policy fingerprint (kblib.effective_priority_policy) the quotas were resolved from; recorded on the priority-quota-compliance receipt so its consumers can bind the policy identity, never re-derive it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--policy-fingerprint"]}},"quota_p0":{"default":15.0,"description":"P0 priority quota in percent (default 15; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p0"],"type":"float"}},"quota_p1":{"default":35.0,"description":"P1 priority quota in percent (default 35; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p1"],"type":"float"}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"vocab":{"description":"path to vocab.yaml (defaults to vocab.yaml next to this script)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--vocab"]}}},"required":["vault_root"],"type":"object"},"name":"check_vocab"},{"description":"Compile the machine-readable CLI invocation contract from every Tools/*.py argparse declaration.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 when it is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"artifact path to write or verify (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root whose Tools/ directory is compiled","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_cli_contract"},{"description":"Compile Required Queue from explicit Coverage assignments","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Queue write or replan","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"registered Amendment id authorizing the replan; required with --apply-replan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"materialize an initially empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"apply_replan":{"default":false,"description":"apply a controlled structural diff to a non-empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply-replan"]}},"coverage_proposal":{"description":"repository-contained .cambium/deltas/replans/*.coverage.yaml input","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_revision":{"description":"compare-and-swap guard: the queue_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-revision"],"type":"int"}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the replan is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"output":{"description":"repository-relative proposal path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"receipts":{"default":".cambium/receipts/queue-structure.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"replan_diff":{"description":"existing .cambium/tmp/*.yaml diff to consume","type":"string","x-cambium-cli":{"action":"store","option_strings":["--replan-diff"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_queue","x-cambium-mutually-exclusive":[{"dests":["apply","apply_replan"],"required":false}]},{"description":"Compose the effective frontmatter page contract from the kernel bases and the selected profile's Metadata Contract.","inputSchema":{"additionalProperties":false,"properties":{"base":{"description":"applicability base to compile from (default: kernel/K08 Metadata and Status/applicability-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"compiled page contract to write, or to compare against under --check (default: Tools/page_contract.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"profile":{"description":"profile directory for a validation run; the vault selection stays with K00/03","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"relationships":{"description":"relationship base to compile from (default: kernel/K08 Metadata and Status/relationship-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--relationships"]}},"root":{"default":".","description":"vault root (default: this repository)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"sources_role":{"description":"sources-role base to compile from (default: kernel/K07 Sources and Accuracy/sources-role-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--sources-role"]}}},"type":"object"},"name":"compose_page_contract"},{"description":"Deterministically compose the vocabulary artifact from the kernel base and the selected profile's extensions.","inputSchema":{"additionalProperties":false,"properties":{"base":{"default":"kernel/K08 Metadata and Status/vocabulary-base.yaml","description":"the kernel vocabulary base the extensions are appended to (default: kernel/K08 Metadata and Status/vocabulary-base.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when values and provenance are identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"extensions":{"description":"the active profile's vocabulary-extensions.yaml. Canonical adopter Standards state selects the path; when this flag is present it must name that same path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--extensions"]}},"output":{"default":"Tools/vocab.yaml","description":"composed vocabulary artifact to write, or to compare against under --check (default: Tools/vocab.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}}},"type":"object"},"name":"compose_vocab"},{"description":"Cross-file duplicate paragraph candidate detection (for maintenance runs and governance tasks)","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"description":"skip files whose path contains this component (repeatable; default: legacy)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to (shared convention, Tools/schemas/receipt.template.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"subpath (relative to vault, or absolute): only report similar pairs with at least one side under it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault":{"default":".","description":"vault root directory (default: current directory)","type":"string","x-cambium-cli":{"action":"store","nargs":"?","option_strings":[]}}},"type":"object"},"name":"duplicate_check"},{"description":"Initialize empty Cambium runtime state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"materialize .cambium/; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"initial Coverage timestamp (default: current UTC)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"completion_semantics":{"description":"build requires completion-candidate plus Terminal Proof; maintenance closes directly through the bounded maintenance completion gate","enum":["build","maintenance"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--completion-semantics"]}},"concurrency_cap":{"description":"explicit task-contract override of K13/10's concurrency cap; omit it to take the selected profile manifest's registered override, or the kernel default 3 when the manifest registers none","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--concurrency-cap"],"type":"int"}},"contract_version":{"default":"c1","description":"non-empty task-contract version recorded on the Progress Ledger contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract-version"]}},"exclusions":{"default":[],"description":"explicit out-of-scope item; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"objective":{"description":"non-empty statement of the task outcome","type":"string","x-cambium-cli":{"action":"store","option_strings":["--objective"]}},"profile_manifest":{"description":"repository-relative selected profile manifest; must equal the selected_profile_manifest of the canonical adopter Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-manifest"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"scope_version":{"description":"non-empty scope identity stamped on the Queue, Coverage Ledger and task contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope-version"]}},"standards_version":{"description":"Standards version this runtime adopts; must equal the approved standards_version of the canonical adopter Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-version"]}},"task_id":{"description":"non-empty task identity stamped on the Queue, Coverage Ledger and Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--task-id"]}}},"required":["root","task_id","objective","scope_version","standards_version","profile_manifest","completion_semantics"],"type":"object"},"name":"init_state"},{"description":"Compile and load Cambium's closed metadata-execution authority contract. This module is deliberately the single authority boundary between metadata declarations and executable writers. A field rule is executable only when an installed writer capability declares the same ``(field, transition, adapter)`` operation, and every installed writer operation must be authorized by exactly one rule. Unknown keys, unknown adapters, orphan implementations, and partial evidence bindings fail closed.","inputSchema":{"additionalProperties":false,"properties":{"authority":{"default":"kernel/K08 Metadata and Status/metadata-authority-base.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--authority"]}},"capabilities":{"default":"Tools/operation-capabilities.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--capabilities"]}},"check":{"default":false,"type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":"Tools/compiled/metadata-execution-contract.json","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"default":".","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"type":"object"},"name":"metadata_execution_contract"},{"description":"Migrate existing runtime identity to Standards state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write state; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"migrate_standards_state"},{"description":"Read-only onboarding status projector: derives the adoption/onboarding state of one root and exactly one next_action token; writes nothing and owns no ledger","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"emit the status view as one deterministic JSON object instead of the human summary","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"target one candidate profile directory name under profiles/ for the full profile-load evaluation (defaults to the single candidate when exactly one exists)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"the adopting repository root to project","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"profile_onboarding_status"},{"description":"Project metadata-contract owner state onto page frontmatter","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"take the runtime writer lock and publish the projection; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"page":{"description":"limit to these repository-relative pages (repeatable); default is every Ledger page","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--page"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"project_page_state"},{"description":"Record one snapshot-bound Batch Review judgment","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"batch":{"description":"exact open Queue batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"judgment_item":{"description":"registered Batch Review Requirement Judgment Item ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--judgment-item"]}},"receipts":{"default":".cambium/receipts/batch-judgments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reviewer_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer-role"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded judgment statement (the concrete verdict, not \"reviewed\")","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"target":{"description":"manifest page path, or the batch ID for a batch-selector requirement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--target"]}}},"required":["root","batch","judgment_item","target","reviewer_role","statement"],"type":"object"},"name":"record_batch_judgment"},{"description":"Record a Profile-authorized Corpus Planning semantic decision as machine-readable JSONL","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared authority Role ID; required with --apply and must equal the Profile/plan binding","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the structural and semantic receipts; default is dry-run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"plan":{"description":"closed restricted-YAML acceptance decision plan; one .yaml file directly under .cambium/deltas/corpus-plan-acceptances/","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/corpus-plan-acceptance.jsonl","description":"repository-relative JSONL path the receipts are appended to (default: .cambium/receipts/corpus-plan-acceptance.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"record_corpus_acceptance"},{"description":"Record snapshot-bound manual Extension Gate evidence","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-attestations.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded manual attestation statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","actor_role","statement"],"type":"object"},"name":"record_gate_attestation"},{"description":"Run a registered scan and record a deterministic Extension Gate result","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"run and append the bound Gate result","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact deterministic typed Profile Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-results.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","gate_id","page"],"type":"object"},"name":"record_gate_result"},{"description":"Register one approved current-protocol Amendment","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may register or withdraw an Amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"id for a queue-replan registration; cross-Ledger operations derive it from --plan instead","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"write the registration; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"approval_reference":{"description":"explicit-user approval reference; required when --decision-mode is explicit-user","type":"string","x-cambium-cli":{"action":"store","option_strings":["--approval-reference"]}},"coverage_proposal":{"description":".cambium/deltas/replans/*.coverage.yaml proposal","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"date":{"description":"YYYY-MM-DD; must equal the UTC registration date","type":"string","x-cambium-cli":{"action":"store","option_strings":["--date"]}},"decision_mode":{"default":"auto","description":"derive delegated authority by default; explicit-user requires --approval-reference","enum":["auto","contract-delegated","explicit-user"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--decision-mode"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the published receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"operation":{"description":"Amendment operation being registered","enum":["cancel-batch","gap-routing-reconciliation","property-state-migration","queue-replan","scope-replan"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--operation"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"reason":{"description":"nonempty withdrawal reason recorded on the row and its receipt","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"summary":{"description":"non-empty one-line rationale recorded on the row","type":"string","x-cambium-cli":{"action":"store","option_strings":["--summary"]}},"withdraw":{"description":"retire the named pending registration instead of registering one (K13/06 withdrawal); requires --reason","type":"string","x-cambium-cli":{"action":"store","option_strings":["--withdraw"]}}},"required":["root","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"register_amendment"},{"description":"Render the K08/09 boundary projection blocks from page `boundary` frontmatter.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_boundary_projection"},{"description":"Render the Cambium MCP server's registration and corpus binding into the configuration file each supported host reads.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"re-render and compare against the existing products; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"distribution_root":{"description":"absolute path of the Cambium checkout the server is launched from; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--distribution-root"]}},"host":{"description":"render only this host's product (default: every host)","enum":["claude-code","codex","dsh-env","dsh-profile-patch","kimi-code"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--host"]}},"output_dir":{"description":"directory to write or verify the products in (default: /Tools/compiled/host-configs)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output-dir"]}},"projection":{"description":"compiled interface projection to bind to (default: /Tools/compiled/mcp-tools.json)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--projection"]}},"root":{"description":"repository root holding the compiled interface projection","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every rendered field and exit without reading or writing any product","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}},"workspace_root":{"description":"absolute path of the corpus repository this registration is bound to; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--workspace-root"]}}},"required":["root"],"type":"object"},"name":"render_host_configs","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Project the compiled CLI invocation contract into the agent-facing interface forms registered in this tool.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing artifacts; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"description":"compiled CLI contract to project (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"form":{"description":"project only this form (default: every registered form)","enum":["mcp"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--form"]}},"output":{"description":"artifact path to write or verify; requires --form, because one path cannot hold two forms","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root holding the compiled CLI contract","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every projected field and exit without reading or writing any artifact","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}}},"required":["root"],"type":"object"},"name":"render_interface_projection","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Render Required Queue human report","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"compare existing report instead of writing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":".cambium/reports/required_queue.md","description":"repository-relative report path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"stdout":{"default":false,"description":"print the report to stdout and write nothing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--stdout"]}}},"required":["root"],"type":"object"},"name":"render_queue"},{"description":"Render derived Structure Registry coverage projections (K01/05 derived roles).","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale or missing; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_structure_projection"},{"description":"Run the adopter verification set derived from the K00/12 Stable Gate ID Registry (deterministic, not-batch-scoped producers).","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path prefix passed through to scanners that accept it (repeatable)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"list":{"default":false,"description":"print the derived set and each command without running anything","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--list"]}},"profile":{"description":"profile directory override; default is the live runtime's selected_profile_manifest","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"run_gates"},{"description":"Scaffold a candidate profile from profiles/_template using the exact-copy whitelist in profiles/template-files.yaml","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"create the candidate; without it the plan is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"candidate profile slug matching [a-z0-9][a-z0-9_-]* (equals the directory name)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"repository root containing profiles/","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","profile_id"],"type":"object"},"name":"scaffold_profile"},{"description":"Seal verified frozen receipt history (K12/07). --apply is a maintenance-window operation: run it only with no other Cambium or adopter writer, checker or receipt appender active against this repository.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the seal, or with --reconcile finish the interrupted one; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/seal-receipts.jsonl","description":"repository-relative JSONL path for this tool's own seal receipts, which never seal (default: .cambium/receipts/seal-receipts.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reconcile":{"default":false,"description":"finish an interrupted seal over the publication paths this tool implements; other interruptions fail closed and are resolved by the runbook in Tools/README.md","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--reconcile"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"verify":{"default":false,"description":"re-prove every sealed segment, projection and seal-receipt binding, then exit","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--verify"]}}},"required":["root"],"type":"object"},"name":"seal_receipts"},{"description":"Stamp kernel Runtime Cards","inputSchema":{"additionalProperties":false,"properties":{"acknowledge_compiled":{"default":false,"description":"after semantic regeneration/review, advance compiled_source_hash to the exact current source digest","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--acknowledge-compiled"]}},"cards_dir":{"default":"kernel/Cards","description":"Card directory relative to (default: kernel/Cards)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--cards-dir"]}},"check":{"default":false,"description":"verify only; never write","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"set_version":{"description":"also set every card's compiled_from value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--set-version"]}}},"required":["root"],"type":"object"},"name":"stamp_cards"},{"description":"Apply one Required Queue transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; Queue transition planning and apply both require integrator","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"batch_receipt":{"default":[],"description":"batch-review gate receipt id for open -> merge-ready; exactly one is accepted","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--batch-receipt"]}},"close_gate_receipt":{"description":"check_batch_close receipt id required by the closed transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--close-gate-receipt"]}},"confirmation_receipt":{"description":"confirmation receipt id required by queued -> open when the batch is confirmation_required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"delta_apply_receipt":{"description":"apply_delta receipt id required by the closed transition and by merge-ready -> open reopen","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-apply-receipt"]}},"delta_path":{"description":"repository-relative .cambium/deltas/.yaml batch delta required by open -> merge-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-path"]}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"gate_receipt":{"description":"gate receipt id: activation gate for queued -> open, Queue consistency gate for closed and for clearing revalidation-required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"hold_state":{"description":"target hold state; exclusive with --transition","enum":["blocked","confirmation-required","none","paused","revalidation-required"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--hold-state"]}},"id":{"description":"Required Queue batch id to transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--id"]}},"json":{"default":false,"description":"write the applied transition receipt(s) to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"reason":{"description":"non-empty rationale required by merge-ready -> open and by any non-none hold","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/queue-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"standards_revalidation_receipt":{"description":"check_queue --require-revalidation receipt discharging an outstanding Standards revalidation; queued -> open or revalidation-required -> none only","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-revalidation-receipt"]}},"transition":{"description":"target lifecycle state; exclusive with --hold-state","enum":["closed","merge-ready","open"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","id"],"type":"object"},"name":"update_queue","x-cambium-mutually-exclusive":[{"dests":["transition","hold_state"],"required":true}]},{"description":"Apply one canonical task-state transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a task-state write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"checkpoint_summary":{"description":"non-empty reason required by paused, blocked and cancelled, and when leaving completion-candidate for anything but complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--checkpoint-summary"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the applied transition receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"maintenance_completion_receipt":{"description":"maintenance completion gate receipt id required by complete under maintenance completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--maintenance-completion-receipt"]}},"queue_check_receipt":{"description":"Queue completion gate receipt id required by the completion-candidate transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--queue-check-receipt"]}},"receipts":{"default":".cambium/receipts/task-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"terminal_proof_receipt":{"description":"Terminal Proof receipt id required by complete under build completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--terminal-proof-receipt"]}},"transition":{"description":"target task state in the Progress Ledger","enum":["active","blocked","cancelled","complete","completion-candidate","paused"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","transition"],"type":"object"},"name":"update_task"}],"transports":["stdio","streamable-http"]} diff --git a/Tools/compiled/metadata-execution-contract.json b/Tools/compiled/metadata-execution-contract.json index 7f67821..fb2db2c 100644 --- a/Tools/compiled/metadata-execution-contract.json +++ b/Tools/compiled/metadata-execution-contract.json @@ -1 +1 @@ -{"artifact":"metadata-execution-contract","capability_implementations":[{"path":"Tools/apply_amendment.py","sha256":"sha256:d541f4de5caa0b55c68817c406c820de856a675b030a716eaab10e47f3fad4d8"},{"path":"Tools/apply_delta.py","sha256":"sha256:3749db54ecc0d713c657eb32d1fe52011d65eb64e3a4c4938430344bcfe957d2"},{"path":"Tools/apply_metadata_transition.py","sha256":"sha256:71d687f1a2afb4006dc19b90bcb27e886ca46ce6e577d294802925523e7ae0cd"},{"path":"Tools/apply_task_plan.py","sha256":"sha256:99b47d8dfc2366098ebb3f7d285dec2bc84c0c834c39efea3b846a06b0a36f5d"},{"path":"Tools/card_activation.py","sha256":"sha256:a5106bf4db90eccfd078ffbd436846c753de5c1a01eb4fb3842ed934b5cecf97"},{"path":"Tools/check_batch_close.py","sha256":"sha256:bc2326400a6dde7863fd1384382475ea98fa78592cd0b67d84e3c817b5bf4d16"},{"path":"Tools/check_queue.py","sha256":"sha256:137aeeffc12be70bb699b7a8243c07a95dce6c2bf2a37228b655c3fe44c639ce"},{"path":"Tools/mcp_server.py","sha256":"sha256:9242ac64abe3baf24d8e6e9586c9bf8bd08ac708e802ee6bd12de00a267db270"},{"path":"Tools/metadata_gate_runtime.py","sha256":"sha256:da4aebb718dcbb37f31116c25e6cee3e374fa1e0a3edb87ab96eac6106ab22a3"},{"path":"Tools/metadata_property_state.py","sha256":"sha256:9fa07bf32b366a0bc1797006485b78f4d614b60c97f8b05c0e3dfa1c16ba2d43"},{"path":"Tools/project_page_state.py","sha256":"sha256:77c500cfbb0435f78908f8ab680f3fa4858c2c4d54cb90ce53e5870ddcfa3de4"},{"path":"Tools/record_gate_attestation.py","sha256":"sha256:73e8ad584a4c8e77f3510c09666496c2c7f2a2dd4b24b8394d6f41f9b9a81e3e"},{"path":"Tools/record_gate_result.py","sha256":"sha256:6111c6ff8bd5bf28fdb659cc891db318c314bd878cc9b75d86c6e2b9a97ed8d0"},{"path":"Tools/register_amendment.py","sha256":"sha256:917e0df2c028908b752e58894b61237807778e169e8e452d96d70458d0317fdc"},{"path":"Tools/update_queue.py","sha256":"sha256:3680ae8592ea307542de1b86bb808cc99e1153b1b244c8aeed8680bf0f7a77ae"}],"contract_fingerprint":"sha256:c4f40a153e53affdef051e54e45e072fd27aa30385c752ecbe7b57def2c9538e","contract_id":"kernel-metadata-execution","field_rules":[{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].authoring_status","evidence_requirement":null,"field":"authoring_status","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].coverage_disposition","evidence_requirement":null,"field":"coverage_disposition","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":null,"field":"last_content_modified","invalidation_rule":"owner-property-state-change-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"accepted-at-utc-date"},"field":"last_content_modified","invalidation_rule":"superseded-by-later-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":null,"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"reviewed-content","content_binding":"exact-page-content-sha256","excluded_change_classes":[],"invalidation":"invalidated-by-null","protocol":"current-page-review-v1","result":"pass","target_binding":"exact-page-path","value_selector":"checked-at-utc-date"},"field":"last_reviewed","invalidation_rule":"superseded-by-review-or-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"current-review-receipt-value-v1","transition":"review-completed","value_shape":"date","write_timing":"review-evidence-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"tombstone-null"},"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"tombstone-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].next_batch","evidence_requirement":null,"field":"next_batch","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"}],"operation_capabilities":[{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_metadata_transition.py","Tools/metadata_property_state.py"],"kind":"consumer","operations":[{"operation":"typed-field-metadata-transition"}]},{"capability_id":"card-context-delivery-v1","capability_version":"1.0.2","implementation_paths":["Tools/card_activation.py","Tools/check_queue.py","Tools/mcp_server.py","Tools/update_queue.py"],"kind":"producer","operations":[]},{"capability_id":"manual-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_attestation.py"],"kind":"producer","operations":[]},{"capability_id":"registered-scan-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_result.py"],"kind":"producer","operations":[]},{"capability_id":"deterministic-gate-result-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"manual-gate-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}],"schema_version":1,"source_adapters":[{"adapter_id":"content-change-event-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]},{"adapter_id":"coverage-property-state-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":["content_fingerprint","evidence_receipt","value"]},{"adapter_id":"coverage-row-value-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":[]},{"adapter_id":"current-review-receipt-value-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]}],"temporal_order":["first_seen","last_content_modified","last_reviewed","last_verified"],"writer_capabilities":[{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}]} +{"artifact":"metadata-execution-contract","capability_implementations":[{"path":"Tools/apply_amendment.py","sha256":"sha256:d541f4de5caa0b55c68817c406c820de856a675b030a716eaab10e47f3fad4d8"},{"path":"Tools/apply_delta.py","sha256":"sha256:3749db54ecc0d713c657eb32d1fe52011d65eb64e3a4c4938430344bcfe957d2"},{"path":"Tools/apply_metadata_transition.py","sha256":"sha256:71d687f1a2afb4006dc19b90bcb27e886ca46ce6e577d294802925523e7ae0cd"},{"path":"Tools/apply_task_plan.py","sha256":"sha256:99b47d8dfc2366098ebb3f7d285dec2bc84c0c834c39efea3b846a06b0a36f5d"},{"path":"Tools/card_activation.py","sha256":"sha256:a5106bf4db90eccfd078ffbd436846c753de5c1a01eb4fb3842ed934b5cecf97"},{"path":"Tools/check_batch_close.py","sha256":"sha256:bc2326400a6dde7863fd1384382475ea98fa78592cd0b67d84e3c817b5bf4d16"},{"path":"Tools/check_queue.py","sha256":"sha256:5e0db75e6b6d7b209b7764092e3c54f71d02560357d38d5b77118f772c1cc07d"},{"path":"Tools/mcp_server.py","sha256":"sha256:9242ac64abe3baf24d8e6e9586c9bf8bd08ac708e802ee6bd12de00a267db270"},{"path":"Tools/metadata_gate_runtime.py","sha256":"sha256:da4aebb718dcbb37f31116c25e6cee3e374fa1e0a3edb87ab96eac6106ab22a3"},{"path":"Tools/metadata_property_state.py","sha256":"sha256:9fa07bf32b366a0bc1797006485b78f4d614b60c97f8b05c0e3dfa1c16ba2d43"},{"path":"Tools/project_page_state.py","sha256":"sha256:77c500cfbb0435f78908f8ab680f3fa4858c2c4d54cb90ce53e5870ddcfa3de4"},{"path":"Tools/record_gate_attestation.py","sha256":"sha256:73e8ad584a4c8e77f3510c09666496c2c7f2a2dd4b24b8394d6f41f9b9a81e3e"},{"path":"Tools/record_gate_result.py","sha256":"sha256:6111c6ff8bd5bf28fdb659cc891db318c314bd878cc9b75d86c6e2b9a97ed8d0"},{"path":"Tools/register_amendment.py","sha256":"sha256:917e0df2c028908b752e58894b61237807778e169e8e452d96d70458d0317fdc"},{"path":"Tools/update_queue.py","sha256":"sha256:3680ae8592ea307542de1b86bb808cc99e1153b1b244c8aeed8680bf0f7a77ae"}],"contract_fingerprint":"sha256:806167463adb1942a22a51a805ad1ae82f18ca45b2959f6206f36876e35b5817","contract_id":"kernel-metadata-execution","field_rules":[{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].authoring_status","evidence_requirement":null,"field":"authoring_status","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].coverage_disposition","evidence_requirement":null,"field":"coverage_disposition","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":null,"field":"last_content_modified","invalidation_rule":"owner-property-state-change-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"accepted-at-utc-date"},"field":"last_content_modified","invalidation_rule":"superseded-by-later-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":null,"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"reviewed-content","content_binding":"exact-page-content-sha256","excluded_change_classes":[],"invalidation":"invalidated-by-null","protocol":"current-page-review-v1","result":"pass","target_binding":"exact-page-path","value_selector":"checked-at-utc-date"},"field":"last_reviewed","invalidation_rule":"superseded-by-review-or-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"current-review-receipt-value-v1","transition":"review-completed","value_shape":"date","write_timing":"review-evidence-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"tombstone-null"},"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"tombstone-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].next_batch","evidence_requirement":null,"field":"next_batch","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"}],"operation_capabilities":[{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_metadata_transition.py","Tools/metadata_property_state.py"],"kind":"consumer","operations":[{"operation":"typed-field-metadata-transition"}]},{"capability_id":"card-context-delivery-v1","capability_version":"1.0.2","implementation_paths":["Tools/card_activation.py","Tools/check_queue.py","Tools/mcp_server.py","Tools/update_queue.py"],"kind":"producer","operations":[]},{"capability_id":"manual-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_attestation.py"],"kind":"producer","operations":[]},{"capability_id":"registered-scan-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_result.py"],"kind":"producer","operations":[]},{"capability_id":"deterministic-gate-result-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"manual-gate-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}],"schema_version":1,"source_adapters":[{"adapter_id":"content-change-event-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]},{"adapter_id":"coverage-property-state-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":["content_fingerprint","evidence_receipt","value"]},{"adapter_id":"coverage-row-value-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":[]},{"adapter_id":"current-review-receipt-value-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]}],"temporal_order":["first_seen","last_content_modified","last_reviewed","last_verified"],"writer_capabilities":[{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}]} diff --git a/Tools/compose_page_contract.py b/Tools/compose_page_contract.py index f090968..fcf938f 100644 --- a/Tools/compose_page_contract.py +++ b/Tools/compose_page_contract.py @@ -11,7 +11,7 @@ (default "kernel/K08 Metadata and Status/relationship-base.yaml"; semantic owner K08/08) the selected profile's `Metadata Contract` and `Vocabulary Extensions` - slots. The active `selected_profile_manifest` in K00/03 determines the + slots. The canonical adopter Standards state determines the selection; `--profile` names a profile directory explicitly for validation runs and never selects it for the vault. @@ -61,7 +61,7 @@ "kernel/K07 Sources and Accuracy/sources-role-base.yaml" ) DEFAULT_OUTPUT = "Tools/page_contract.yaml" -ACTIVE_STATE_PATH = "kernel/K00 Standards Control/03 Standards Governance.md" +ACTIVE_STATE_PATH = ".cambium/governance/standards_state.yaml" METADATA_SLOT = "Metadata Contract" VOCAB_SLOT = "Vocabulary Extensions" PROVENANCE_RE = re.compile( diff --git a/Tools/compose_vocab.py b/Tools/compose_vocab.py index 824aade..250440a 100644 --- a/Tools/compose_vocab.py +++ b/Tools/compose_vocab.py @@ -6,8 +6,8 @@ --base kernel vocabulary base (default: "kernel/K08 Metadata and Status/vocabulary-base.yaml") - --extensions selected profile's vocabulary extensions. The active - `selected_profile_manifest` in K00/03 determines the one + --extensions selected profile's vocabulary extensions. The canonical + adopter Standards state determines the one allowed `Vocabulary Extensions` binding. The flag may repeat that path explicitly; it cannot choose a different profile. The @@ -57,7 +57,7 @@ DEFAULT_BASE = "kernel/K08 Metadata and Status/vocabulary-base.yaml" DEFAULT_OUTPUT = "Tools/vocab.yaml" -ACTIVE_STATE_PATH = "kernel/K00 Standards Control/03 Standards Governance.md" +ACTIVE_STATE_PATH = ".cambium/governance/standards_state.yaml" UNINSTANTIATED_RE = re.compile(r"\{\{.*?\}\}") # There is deliberately no DEFAULT_EXTENSIONS. Naming one profile here would @@ -183,7 +183,7 @@ def report_inactive_selection(errors): candidates = discover_profiles() if candidates: print(" Profile manifest candidates found (candidates are not active " - "until K00/03 selects one):") + "until canonical adopter Standards state selects one):") for item in candidates: print(" %s" % item) else: @@ -577,8 +577,9 @@ def main(argv=None): parser.add_argument( "--extensions", default=None, - help="the active profile's %s. K00/03 selects the path; when this " - "flag is present it must name that same path" + help="the active profile's %s. Canonical adopter Standards state " + "selects the path; when this " + "flag is present it must name that same path" % EXTENSIONS_BASENAME, ) parser.add_argument("--output", default=DEFAULT_OUTPUT, diff --git a/Tools/init_state.py b/Tools/init_state.py index aa037f1..44c13a1 100644 --- a/Tools/init_state.py +++ b/Tools/init_state.py @@ -1,8 +1,9 @@ #!/usr/bin/env python3 """Materialize an adopter's empty ``.cambium/`` runtime state. -Initialization never invents Required work. It refuses any existing runtime -namespace and is a dry run unless ``--apply`` is present. +Initialization never invents Required work. It refuses an existing task +runtime, preserves a governance-only ``.cambium/`` namespace, and is a dry +run unless ``--apply`` is present. """ import ctypes @@ -21,7 +22,7 @@ import kblib TOOL = "init_state" -TOOL_VERSION = "1.3.0" +TOOL_VERSION = "1.4.0" RUNTIME_DIRS = ( "state", "work_specs", "deltas", "receipts", "reports", "tmp", ) @@ -319,6 +320,100 @@ def publish_runtime(root, documents, *, pre_publish_validator=None, shutil.rmtree(staging) +def _governance_only_namespace_errors(root): + """Return errors when an existing namespace is not pre-runtime state.""" + runtime = os.path.join(root, ".cambium") + if not os.path.lexists(runtime): + return [] + if os.path.islink(runtime) or not os.path.isdir(runtime): + return [".cambium must be a real directory"] + allowed = { + "governance": {"standards_state.yaml"}, + "receipts": {"standards-adoptions.jsonl"}, + } + errors = [] + if not os.path.isfile(os.path.join( + runtime, "governance", "standards_state.yaml")): + errors.append( + "pre-runtime .cambium must contain governance/standards_state.yaml") + for name in sorted(os.listdir(runtime)): + path = os.path.join(runtime, name) + if name not in allowed: + errors.append("pre-runtime .cambium contains %s" % name) + continue + if os.path.islink(path) or not os.path.isdir(path): + errors.append("pre-runtime .cambium/%s must be a real directory" % + name) + continue + entries = set(os.listdir(path)) + unexpected = sorted(entries - allowed[name]) + for entry in unexpected: + errors.append("pre-runtime .cambium/%s contains %s" % + (name, entry)) + for entry in sorted(entries & allowed[name]): + target = os.path.join(path, entry) + if os.path.islink(target) or not os.path.isfile(target): + errors.append("pre-runtime .cambium/%s/%s must be a regular " + "file" % (name, entry)) + return errors + + +def publish_runtime_into_governance_namespace( + root, documents, *, pre_publish_validator, + post_publish_validator, lock_operation): + """Publish task runtime directories beside preserved governance state.""" + errors = _governance_only_namespace_errors(root) + if errors: + raise FileExistsError("; ".join(errors)) + runtime = os.path.join(root, ".cambium") + expected = { + "coverage_ledger.yaml", "required_queue.yaml", "progress_ledger.yaml" + } + if set(documents) != expected: + raise ValueError( + "runtime initialization requires exactly the three state files") + staging = tempfile.mkdtemp(prefix=".cambium-init-", dir=root) + moved = [] + publish_dirs = ["tmp", "state", "work_specs", "deltas", "reports"] + if not os.path.lexists(os.path.join(runtime, "receipts")): + publish_dirs.append("receipts") + publish_dirs = tuple(publish_dirs) + try: + for directory in publish_dirs: + os.makedirs(os.path.join(staging, directory), exist_ok=False) + for name, text in documents.items(): + target = os.path.join(staging, "state", name) + kblib.atomic_write_text( + target, text, validator=kblib.parse_yaml_subset) + pre_publish_validator() + _create_publication_lock(staging, lock_operation) + try: + for directory in publish_dirs: + source = os.path.join(staging, directory) + target = os.path.join(runtime, directory) + _rename_noreplace(source, target) + moved.append(directory) + _fsync_directory(runtime) + post_publish_validator() + except BaseException as publication_error: + try: + for directory in reversed(moved): + _rename_noreplace( + os.path.join(runtime, directory), + os.path.join(staging, directory)) + _fsync_directory(runtime) + except BaseException as rollback_error: + raise ValueError( + "runtime publication failed and rollback is incomplete: " + "publication=%s; rollback=%s" % + (publication_error, rollback_error)) from publication_error + raise + _remove_publication_lock(runtime, lock_operation) + finally: + if os.path.lexists(staging): + shutil.rmtree(staging) + + KERNEL_CONCURRENCY_CAP = 3 @@ -562,11 +657,11 @@ def main(argv=None): parser.add_argument("--standards-version", required=True, help="Standards version this runtime adopts; must " "equal the approved standards_version of the " - "active K00/03 Standards Control") + "canonical adopter Standards state") parser.add_argument("--profile-manifest", required=True, help="repository-relative selected profile manifest; " "must equal the selected_profile_manifest of " - "the active K00/03 Standards Control") + "the canonical adopter Standards state") parser.add_argument("--contract-version", default="c1", help="non-empty task-contract version recorded on " "the Progress Ledger contract") @@ -627,8 +722,15 @@ def main(argv=None): return 1 runtime = os.path.join(root, ".cambium") - if os.path.lexists(runtime): + task_state = os.path.join(runtime, "state") + governance_only = os.path.lexists(runtime) and not os.path.lexists( + task_state) + namespace_errors = (_governance_only_namespace_errors(root) + if governance_only else []) + if os.path.lexists(task_state) or namespace_errors: _report_existing_runtime(root, ".cambium already exists") + for error in namespace_errors: + print("[FAIL] %s" % error) return 1 if args.at is None: args.at = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()) @@ -690,7 +792,9 @@ def revalidate_profile(phase): kblib.sha256_bytes(documents["required_queue.yaml"]), } try: - publish_runtime( + publisher = (publish_runtime_into_governance_namespace + if governance_only else publish_runtime) + publisher( root, documents, pre_publish_validator=lambda: revalidate_profile( "pre-publication"), diff --git a/Tools/migrate_standards_state.py b/Tools/migrate_standards_state.py new file mode 100644 index 0000000..83ee4e4 --- /dev/null +++ b/Tools/migrate_standards_state.py @@ -0,0 +1,172 @@ +#!/usr/bin/env python3 +"""Materialize canonical adopter Standards state from an existing runtime. + +This is a one-time compatibility bridge for adopters whose current identity is +still repeated across the three task ledgers. It does not create an adoption, +rewrite history, or read K00/03 as mutable state. +""" + +import json +import os +import sys +import datetime + +sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) +import kblib +import standards_state + +TOOL = "migrate_standards_state" +TOOL_VERSION = "1.0.0" +QUEUE_PATH = ".cambium/state/required_queue.yaml" +COVERAGE_PATH = ".cambium/state/coverage_ledger.yaml" +PROGRESS_PATH = ".cambium/state/progress_ledger.yaml" +HISTORY_PATH = ".cambium/receipts/standards-adoptions.jsonl" + + +def _read_yaml(root, relative): + path = kblib.managed_repository_path( + root, relative, os.path.dirname(relative), + suffixes=(".yaml",), must_exist=True) + with open(path, "rb") as stream: + raw = stream.read() + return path, raw, kblib.parse_yaml_subset(raw.decode("utf-8")) + + +def _history(root): + path = kblib.managed_repository_path( + root, HISTORY_PATH, ".cambium/receipts", + suffixes=(".jsonl",), must_exist=True) + with open(path, "rb") as stream: + raw = stream.read() + rows = [] + for number, line in enumerate(raw.decode("utf-8").splitlines(), 1): + if not line.strip(): + continue + try: + row = json.loads(line) + except json.JSONDecodeError as exc: + raise ValueError("history line %d is not JSON: %s" % + (number, exc)) + if not isinstance(row, dict): + raise ValueError("history line %d is not an object" % number) + rows.append(row) + return path, raw, rows + + +def prepare(root): + root = os.path.realpath(os.path.abspath(root)) + target = os.path.join(root, standards_state.STATE_PATH) + if os.path.lexists(target): + raise ValueError("canonical Standards state already exists") + snapshots = {} + documents = {} + for name, relative in (("queue", QUEUE_PATH), ("coverage", COVERAGE_PATH), + ("progress", PROGRESS_PATH)): + path, raw, document = _read_yaml(root, relative) + snapshots[path] = raw + documents[name] = document + history_path, history_raw, rows = _history(root) + snapshots[history_path] = history_raw + + queue = documents["queue"] + coverage = documents["coverage"] + progress = documents["progress"] + contract = progress.get("contract") if isinstance(progress, dict) else None + if not all(isinstance(value, dict) for value in + (queue, coverage, progress, contract)): + raise ValueError("runtime ledgers do not have the required mappings") + versions = { + queue.get("standards_version"), coverage.get("standards_version"), + contract.get("standards_version")} + profiles = { + queue.get("selected_profile_manifest"), + coverage.get("selected_profile_manifest"), + contract.get("selected_profile_manifest")} + if len(versions) != 1 or not all( + isinstance(value, str) and value for value in versions): + raise ValueError("runtime ledgers disagree on standards_version") + if len(profiles) != 1 or not all( + isinstance(value, str) and value for value in profiles): + raise ValueError( + "runtime ledgers disagree on selected_profile_manifest") + version = next(iter(versions)) + profile = next(iter(profiles)) + commits = [row for row in rows + if row.get("tool") in + ("adopt_standards", "apply_profile_adoption") and + row.get("result") == "pass" and + row.get("transaction_phase") == "commit" and + row.get("standards_version_after") == version and + isinstance(row.get("receipt_id"), str)] + if not commits: + raise ValueError( + "no committed adoption receipt accounts for live Standards %s" % + version) + commit = commits[-1] + checked_at = commit.get("checked_at") + try: + effective_date = datetime.date.fromisoformat( + checked_at[:10]).isoformat() + except (AttributeError, TypeError, ValueError): + effective_date = None + if effective_date is None: + raise ValueError("latest adoption receipt has no usable checked_at") + document = { + "schema_version": 1, + "state_revision": 1, + "standards_version": version, + "status": "approved", + "effective_date": effective_date, + "selected_profile_manifest": profile, + "latest_adoption_receipt": commit["receipt_id"], + "upstream_source_ref": commit.get("upstream_source_ref"), + "upstream_revision_id": commit.get("upstream_revision_id"), + } + text = standards_state.canonical_text(document) + return root, target, snapshots, document, text + + +def main(argv=None): + parser = kblib.ArgumentParser( + description="Migrate existing runtime identity to Standards state") + parser.add_argument("root", help="adopting repository root") + parser.add_argument("--apply", action="store_true", + help="write state; omit for a dry run") + args = parser.parse_args(argv) + try: + root, target, snapshots, document, text = prepare(args.root) + except (OSError, UnicodeError, ValueError, kblib.YamlSubsetError) as exc: + print("[FAIL] cannot migrate Standards state: %s" % exc) + return 1 + print("migration plan:") + print(" standards_version=%s" % document["standards_version"]) + print(" selected_profile_manifest=%s" % + document["selected_profile_manifest"]) + print(" latest_adoption_receipt=%s" % + document["latest_adoption_receipt"]) + print(" target=%s" % standards_state.STATE_PATH) + if not args.apply: + print("dry run; add --apply to write the state") + return 0 + for path, raw in snapshots.items(): + with open(path, "rb") as stream: + current = stream.read() + if current != raw: + print("[FAIL] migration input changed before publication") + return 1 + os.makedirs(os.path.dirname(target), exist_ok=True) + try: + def validate(value): + _state, errors = standards_state.parse(value) + if errors: + raise ValueError("; ".join(errors)) + kblib.atomic_write_text(target, text, validator=validate) + except (OSError, ValueError, kblib.YamlSubsetError) as exc: + print("[FAIL] cannot publish Standards state: %s" % exc) + return 1 + print("[PASS] migrated canonical adopter Standards state") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/Tools/profile_admission.py b/Tools/profile_admission.py index b20f52b..7247231 100644 --- a/Tools/profile_admission.py +++ b/Tools/profile_admission.py @@ -13,6 +13,7 @@ import check_profile import kblib +import standards_state def _profile_load_inputs_sha256(root): @@ -143,9 +144,7 @@ def admission_from_evaluation(root, evaluation, *, active_state=None, def admit_profile(root, override=None, *, - active_state_path=( - "kernel/K00 Standards Control/" - "03 Standards Governance.md"), + active_state_path=standards_state.STATE_PATH, require_approved=False): """Return ``(admission, errors)`` for one complete Profile evaluation. @@ -171,23 +170,19 @@ def admit_profile(root, override=None, *, override ] else: - try: - state_snapshot = kblib.repository_file_snapshot( - root, active_state_path, singly_linked=True) - state_raw = state_snapshot.data - state_text = state_snapshot.read_text() - except (OSError, UnicodeError, ValueError) as exc: + if active_state_path != standards_state.STATE_PATH: return None, [ - "cannot read the active Standards state %s: %s" % - (active_state_path, exc) - ] - active_state_repo_path = state_snapshot.repository_path - active_state_sha256 = state_snapshot.sha256 - active_state, parse_errors = kblib.active_standards_state(state_text) - errors.extend( - "%s: %s" % (active_state_path, error) - for error in parse_errors - ) + "active_state_path must be the canonical adopter state %s; " + "Kernel Markdown is not instance state" % + standards_state.STATE_PATH] + active_state, state_view, parse_errors = standards_state.snapshot(root) + errors.extend("%s: %s" % (active_state_path, error) + for error in parse_errors) + if state_view is not None: + active_state_repo_path = state_view["active_standards_path"] + active_state_sha256 = state_view["active_standards_sha256"] + if active_state is None: + return None, errors expected_manifest = active_state.get("selected_profile_manifest") if (not isinstance(expected_manifest, str) or not expected_manifest.strip() or @@ -197,10 +192,10 @@ def admit_profile(root, override=None, *, "for an explicit validation run" ) if (require_approved and - active_state.get("standards_status") != "approved"): + active_state.get("status") != "approved"): errors.append( "active Standards Status must be approved; found %r" % - active_state.get("standards_status") + active_state.get("status") ) if errors: return None, errors @@ -272,7 +267,7 @@ def currency_errors(admission): "active Standards state changed after profile-load admission; " "rerun against one stable Profile selection" ] - state, parse_errors = kblib.active_standards_state(state_text) + state, parse_errors = standards_state.parse(state_text) if parse_errors: return [ "active Standards state became invalid after profile-load " diff --git a/Tools/profile_onboarding_status.py b/Tools/profile_onboarding_status.py index 0e0a2bc..b8e77db 100644 --- a/Tools/profile_onboarding_status.py +++ b/Tools/profile_onboarding_status.py @@ -14,7 +14,8 @@ * it never writes, never creates receipts, never mutates state, and keeps no second authoritative ledger -- every reported value is derived from - bytes owned elsewhere (K00/03, profiles/, the corpus tree, `.cambium/`); + bytes owned elsewhere (adopter Standards state, profiles/, the corpus tree, + `.cambium/`); * it evaluates a targeted candidate through ``check_profile``'s in-process ``evaluate_profile_load`` (which itself writes nothing) and classifies its findings through ``check_profile.FINDING_CATEGORIES``, so an assisting @@ -25,10 +26,10 @@ ``next_action`` precedence (first match wins): 1. root lacks kernel/ + profiles/ + Tools/ -> ``not-a-cambium-root`` -2. `.cambium/` present -> ``resume-existing-task`` +2. `.cambium/state/` present -> ``resume-existing-task`` (existing-task recovery always wins; scaffolding or adoption must not proceed over runtime state) -3. K00/03 partially instantiated or unreadable -> ``repair-control-state`` +3. Standards state malformed or unreadable -> ``repair-control-state`` 4. pre-adoption, no candidate, a missing targeted candidate, or several candidates without ``--profile-id`` -> ``confirm-profile-identity`` 5. pre-adoption, targeted candidate fails @@ -58,13 +59,12 @@ sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) import check_profile import kblib +import standards_state TOOL = "profile_onboarding_status" -TOOL_VERSION = "1.0.0" +TOOL_VERSION = "1.1.0" -ACTIVE_STATE_RELATIVE = ( - "kernel/K00 Standards Control/03 Standards Governance.md" -) +ACTIVE_STATE_RELATIVE = standards_state.STATE_PATH DEFAULTS_RELATIVE = "Tools/schemas/execution_defaults.template.yaml" CORPUS_PLANNING_SLOT = "Corpus Planning" MANIFEST_NAME = "profile.md" @@ -98,38 +98,32 @@ def unfilled_sentinel(root): def standards_view(root): - """Project K00/03's four adopter placeholders into one state token. + """Project the canonical adopter state into one onboarding token. Returns ``(state, values, uninstantiated, problems)`` where ``state`` is - ``pre-adoption`` (all four uninstantiated), ``adopted`` (all four - instantiated), or ``inconsistent`` (partial instantiation, an unreadable - control file, or a malformed Standards Control table). + ``pre-adoption`` (state absent), ``adopted`` (valid state), or + ``inconsistent`` (unsafe, unreadable, or malformed state). """ path = os.path.join(root, *ACTIVE_STATE_RELATIVE.split("/")) + fields = ["effective_date", "selected_profile_manifest", "status", + "standards_version"] + if not os.path.lexists(path): + return "pre-adoption", None, fields, [] try: text = read_text(path) except (OSError, UnicodeError) as exc: - return ("inconsistent", None, sorted( - kblib.ACTIVE_STANDARDS_STATE_LABELS.values()), [ + return ("inconsistent", None, fields, [ "cannot read %s: %s" % (ACTIVE_STATE_RELATIVE, exc)]) - state, parse_errors = kblib.active_standards_state(text) + try: + state, parse_errors = standards_state.parse(text) + except (TypeError, ValueError, kblib.YamlSubsetError) as exc: + return "inconsistent", None, fields, [ + "%s: %s" % (ACTIVE_STATE_RELATIVE, exc)] problems = ["%s: %s" % (ACTIVE_STATE_RELATIVE, error) for error in parse_errors] - fields = sorted(kblib.ACTIVE_STANDARDS_STATE_LABELS.values()) - uninstantiated = sorted( - field for field in fields - if not str(state.get(field) or "").strip() - or "{{" in str(state.get(field) or "")) if problems: - return "inconsistent", None, uninstantiated, problems - if not uninstantiated: - return ("adopted", {field: state[field] for field in fields}, - [], []) - if uninstantiated == fields: - return "pre-adoption", None, uninstantiated, [] - return "inconsistent", None, uninstantiated, [ - "K00/03 is partially instantiated; still uninstantiated: %s" - % ", ".join(uninstantiated)] + return "inconsistent", None, [], problems + return ("adopted", {field: state[field] for field in fields}, [], []) def corpus_planning_state(root, profile_dir): @@ -252,10 +246,10 @@ def corpus_page_count(root): def runtime_view(root): cambium = os.path.join(root, ".cambium") - present = os.path.isdir(cambium) + state_dir = os.path.join(cambium, "state") + present = os.path.isdir(state_dir) state_has_content = False if present: - state_dir = os.path.join(cambium, "state") try: state_has_content = bool(os.listdir(state_dir)) except OSError: @@ -350,16 +344,9 @@ def derive_status(root, targeted_id): view["next_action"] = "repair-control-state" for problem in problems: notes.append(problem) - if uninstantiated and len(uninstantiated) < 4: - notes.append( - "K00/03 Standards Control is partially instantiated; " - "uninstantiated field(s): %s -- repair the control table " - "to one coherent state (all four placeholders, or all four " - "adopted values) before anything else" - % ", ".join(uninstantiated)) - elif not problems: + if not problems: notes.append( - "K00/03 Standards Control is not in a coherent state; " + "the canonical adopter Standards state is not coherent; " "repair it before anything else") return view @@ -392,8 +379,8 @@ def derive_status(root, targeted_id): view["next_action"] = "authorize-r09" notes.append( "candidate profiles/%s passes profile-load; selection and " - "adoption remain an R09 governance decision: instantiate " - "the four K00/03 values against %s/profile.md, then run " + "adoption remain an R09 governance decision: create the " + "canonical adopter Standards state for %s/profile.md, then run " "the write-back checklist" % (targeted, entry["directory"])) else: view["next_action"] = "complete-profile-interview" diff --git a/Tools/render_boundary_projection.py b/Tools/render_boundary_projection.py index e50b6d3..8dc96a3 100644 --- a/Tools/render_boundary_projection.py +++ b/Tools/render_boundary_projection.py @@ -39,7 +39,7 @@ TOOL = "render_boundary_projection" TOOL_VERSION = "1.1.0" -ACTIVE_STATE_PATH = "kernel/K00 Standards Control/03 Standards Governance.md" +ACTIVE_STATE_PATH = ".cambium/governance/standards_state.yaml" SCOPE_SLOT = "Profile Scope" BEGIN = kblib.BOUNDARY_PROJECTION_BEGIN END = kblib.BOUNDARY_PROJECTION_END diff --git a/Tools/render_structure_projection.py b/Tools/render_structure_projection.py index d9269c8..2b73e2e 100644 --- a/Tools/render_structure_projection.py +++ b/Tools/render_structure_projection.py @@ -43,7 +43,7 @@ TOOL = "render_structure_projection" TOOL_VERSION = "1.1.0" -ACTIVE_STATE_PATH = "kernel/K00 Standards Control/03 Standards Governance.md" +ACTIVE_STATE_PATH = ".cambium/governance/standards_state.yaml" STRUCTURE_SLOT = "Structure Registry" COVERAGE_LEDGER_PATH = ".cambium/state/coverage_ledger.yaml" BEGIN = "" diff --git a/Tools/schemas/profile_adoption_plan.template.yaml b/Tools/schemas/profile_adoption_plan.template.yaml index 8fdde4f..28da60c 100644 --- a/Tools/schemas/profile_adoption_plan.template.yaml +++ b/Tools/schemas/profile_adoption_plan.template.yaml @@ -3,29 +3,27 @@ # Owner standard: kernel/K00 Standards Control/03 Standards Governance.md # Implemented by: Tools/apply_profile_adoption.py # Location: any repository-contained path outside kernel/, the candidate -# profile directory, and .cambium/ (which must not exist for this writer); +# profile directory and .cambium/; # e.g. adoption-plans/.yaml # # The plan is restricted YAML and binds one exact before-state. It drives the # sole writer for the two R09 branches that exist BEFORE any runtime does: -# initial adoption (all four K00/03 placeholders uninstantiated) and a later -# profile revision (all four instantiated). It changes only the four K00/03 -# Standards Control cells, appends one Change Summary row, re-measures the -# K00/16 register cell for K00/03, and recomposes the generated artifacts +# initial adoption (adopter Standards state absent) and a later pre-runtime +# profile revision (state present). It advances only the canonical adopter +# state, appends receipt history, and recomposes the generated artifacts # (vocab.yaml, page_contract.yaml, kernel/Cards) through their own producers. -# It never touches `.cambium/`; an existing runtime routes the revision to -# adopt_standards.py instead. +# It never creates task-runtime state; an existing task runtime routes the +# revision to adopt_standards.py instead. # ============================================================================= -schema_version: 1 +schema_version: 2 plan_id: "PA-001" -# `initial-adoption` requires all four K00/03 placeholders uninstantiated and -# null `*_before` fields below; `profile-revision` requires all four -# instantiated and both `*_before` fields matching the current K00/03 cells. +# `initial-adoption` requires adopter Standards state absent and null before +# identity; `profile-revision` requires state present and matching before data. branch: initial-adoption standards_version_after: TODO(profile-adoption) # The no-runtime writer records only released governance; `approved` is the -# sole admissible status (K00/03 lifecycle: draft -> approved -> superseded). +# sole admissible current-state status. standards_status_after: approved standards_effective_date_after: TODO(profile-adoption) selected_profile_manifest_after: "profiles/my-profile/profile.md" @@ -34,12 +32,16 @@ selected_profile_manifest_after: "profiles/my-profile/profile.md" standards_version_before: null selected_profile_manifest_before: null -# The complete Change cell of the new Change Summary row, verbatim: the change -# description including the profile selection and, when applicable, the -# upstream tag, commit, or archive checksum. One Markdown table cell: no `|` -# and no newline. +# Human-readable change detail embedded in the append-only adoption receipt, +# including the profile selection and, when applicable, upstream provenance. +# It is not copied into K00 or a Card. One scalar: no `|` and no newline. change_summary: TODO(profile-adoption) +# Upstream provenance belongs to receipt history, not Kernel prose. Both +# values are nonempty or both null when no upstream is tracked. +upstream_source_ref: TODO(profile-adoption) +upstream_revision_id: TODO(profile-adoption) + # This writer exists for the no-runtime case, where no task state can consume # a changed predicate. The list MUST be empty; a revision with changed # predicates against an existing runtime is an active-task adoption and @@ -54,6 +56,8 @@ adoption_requirement: none # tool never adopts unseen bytes. # Exact current K00/03 governance file bytes (kblib.sha256_file). k00_03_sha256_before: "sha256:replace-with-current-governance-file-fingerprint" +# null for initial adoption; exact current state SHA for profile-revision. +standards_state_sha256_before: null # The next three come from one passing check_profile.evaluate_profile_load of # the candidate: the deterministic candidate Profile directory tree snapshot, # the typed dependency-contract fingerprint, and the root-owned profile-load diff --git a/Tools/schemas/receipt.template.jsonl b/Tools/schemas/receipt.template.jsonl index ab879bd..6e973a3 100644 --- a/Tools/schemas/receipt.template.jsonl +++ b/Tools/schemas/receipt.template.jsonl @@ -132,7 +132,7 @@ # check_residual_content 1.2.0 / # registered-residual-content; check_queue 1.23.0 / its registered # Required-Queue modes; check_batch_close 1.12.0 / batch-close; check_proof -# 1.17.0 / terminal-proof; and adopt_standards 1.6.0 / +# 1.17.0 / terminal-proof; and adopt_standards 1.7.0 / # standards-adoption. Deterministic producers not shown above -- among them # check_corpus_plan and record_corpus_acceptance -- follow the same rule. Every receipt # created by one of these producer versions carries that exact Gate ID. The @@ -373,11 +373,14 @@ # Queue transition history similarly accepts update_queue/1.2.0 while current # transitions are produced as update_queue/1.5.0 receipts. This receipt-protocol # version is deliberately independent from the update_queue CLI release. -# `adopt_standards.py` 1.6.0 validates the candidate Profile after-image with +# `adopt_standards.py` 1.7.0 validates the candidate Profile after-image with # full `profile-load` before writing state and binds its Profile tree, typed -# dependency graph, root-owned profile-load inputs, and 1.5-era upstream -# identity pair in the plan, adoption receipts, Progress record, and lock -# intent. A `profile-load` invalidation boundary targets exactly +# dependency graph, root-owned profile-load inputs, upstream identity pair, +# exact canonical adopter Standards-state before/after SHA-256 values, and next +# effective date in the plan, adoption receipts, Progress record, and lock +# intent. It advances that state with Coverage, Queue, and Progress as one +# four-state transaction while K00/03 remains unchanged rule bytes. A +# `profile-load` invalidation boundary targets exactly # `selected_profile_manifest_after`; admission is not batch-scoped. Current # changed-predicate leaves project through K00/12 to owner Gate IDs: Queue # consistency is immediate, while native owners remain required at their @@ -385,6 +388,11 @@ # sealed pre-1.4 history may omit the root-input fingerprint, and sealed # pre-1.3 history may omit the typed contract. Replay selects the producer-era # contract and never projects today's fields backward onto immutable history. +# `apply_profile_adoption.py` 2.0.0 uses the same state/history separation +# before task-runtime creation. `migrate_standards_state.py` 1.0.0 is a +# one-time compatibility bridge: it materializes state only after three task +# Ledgers agree and a committed adoption receipt accounts for that live +# identity; it neither rewrites receipts nor creates an adoption event. # Existing receipt IDs remain valid append-only protocol references after generator-format changes; never rewrite historical IDs. # ============================================================================= {"receipt_id": "audit-check_links-20260721T000000Z-4f9c2a7d6e8b4a10b3c5d7e9f1023456-0001", "check": "link-missing", "target": "Topics/Example Topic.md:42", "result": "fail", "details": "[[Example Dependency]] has no matching target (missing)", "checked_at": "2026-07-21T00:00:00Z", "tool": "check_links", "tool_version": "1.6.0", "gate_id": "wiki-link-integrity", "invalidated_by": null} diff --git a/Tools/schemas/standards_adoption_plan.template.yaml b/Tools/schemas/standards_adoption_plan.template.yaml index 6df924c..a44d434 100644 --- a/Tools/schemas/standards_adoption_plan.template.yaml +++ b/Tools/schemas/standards_adoption_plan.template.yaml @@ -10,7 +10,7 @@ # Coverage dispositions. # ============================================================================= -schema_version: 1 +schema_version: 2 adoption_id: "SA-001" task_id: "kb-build-2026-xx" task_state_before: paused @@ -18,10 +18,12 @@ contract_version_before: "c1" contract_version_after: "c2" standards_version_before: TODO(adoption-before) standards_version_after: TODO(adoption-after) +standards_effective_date_after: TODO(adoption-after) selected_profile_manifest_before: "profiles/my-profile/profile.md" selected_profile_manifest_after: "profiles/my-profile/profile.md" governance_revision_ref: "kernel/K00 Standards Control/03 Standards Governance.md" governance_revision_sha256: "sha256:replace-with-current-governance-file-fingerprint" +standards_state_sha256_before: "sha256:replace-with-current-standards-state-fingerprint" # Where the adopted revision came from. The distribution publishes no # version numbers by design, so this pair is what makes upstream and # downstream comparable: name the upstream source (repository URL or name) diff --git a/Tools/schemas/standards_state.template.yaml b/Tools/schemas/standards_state.template.yaml new file mode 100644 index 0000000..e30f15f --- /dev/null +++ b/Tools/schemas/standards_state.template.yaml @@ -0,0 +1,13 @@ +# Canonical adopter Standards/Profile current state. +# Owner: kernel/K00 Standards Control/03 Standards Governance.md +# Path: .cambium/governance/standards_state.yaml +# History: .cambium/receipts/standards-adoptions.jsonl +schema_version: 1 +state_revision: 1 +standards_version: TODO(standards-adoption) +status: approved +effective_date: TODO(standards-adoption) +selected_profile_manifest: "profiles/my-profile/profile.md" +latest_adoption_receipt: TODO(standards-adoption) +upstream_source_ref: TODO(standards-adoption) +upstream_revision_id: TODO(standards-adoption) diff --git a/Tools/stamp_cards.py b/Tools/stamp_cards.py index 3ac6ec6..e08488f 100644 --- a/Tools/stamp_cards.py +++ b/Tools/stamp_cards.py @@ -8,8 +8,10 @@ route registries, the Read Set files, and the Runtime Cards must agree exactly on the continuous route set R01-R13. A Read Set and its Card share route_id; indexes have no route identity of their own. Every Card's `compiled_from` must -equal the active `standards_version` recorded in K00/03; uniform but obsolete -version stamps are stale, not synchronized. +equal the canonical adopter `standards_version`; in the uninstantiated public +distribution, the explicit template/version supplied by the release workflow +is authoritative. Uniform but obsolete version stamps are stale, not +synchronized. `source_hash` is the first 12 hexadecimal digits of SHA-256 over each source file's bytes, concatenated in source_files order. `compiled_source_hash` is a @@ -83,6 +85,7 @@ sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) import kblib import check_queue +import standards_state DEFAULT_CARDS_DIR = "kernel/Cards" @@ -92,7 +95,7 @@ REGISTRY_ID = "kernel-runtime-routes" ROUTE_ID_RE = re.compile(r"^R([0-9]{2})$") EXPECTED_ROUTE_IDS = tuple("R%02d" % number for number in range(1, 14)) -ACTIVE_STATE_PATH = "kernel/K00 Standards Control/03 Standards Governance.md" +ACTIVE_STATE_PATH = standards_state.STATE_PATH CODE_SPAN_RE = re.compile(r"`([^`\n]+)`") COMMAND_PREFIX = "python3" SKELETON_OWNER_PATH = ( @@ -877,37 +880,19 @@ def main(): failures = [] tool_contracts = {} - active_path = as_repo_path( - root, ACTIVE_STATE_PATH, "active Standards state", failures - ) active_version = "" - if active_path is not None: - if not active_path.is_file(): - failures.append( - "active Standards state is not a regular file: %s" - % ACTIVE_STATE_PATH - ) - else: - try: - active_text = active_path.read_text(encoding="utf-8") - except (OSError, UnicodeError) as exc: - failures.append("active Standards state is unreadable: %s" % exc) - else: - active_state, state_errors = kblib.active_standards_state( - active_text - ) - failures.extend( - "%s: %s" % (ACTIVE_STATE_PATH, error) - for error in state_errors - ) - active_version = str( - active_state.get("standards_version") or "" - ).strip() - if not active_version: - failures.append( - "%s has no usable Standards version" - % ACTIVE_STATE_PATH - ) + active_path = root / ACTIVE_STATE_PATH + if active_path.exists(): + active_state, _view, state_errors = standards_state.snapshot(root) + failures.extend("%s: %s" % (ACTIVE_STATE_PATH, error) + for error in state_errors) + if active_state is not None: + active_version = str(active_state["standards_version"]).strip() + else: + # The public distribution is deliberately uninstantiated. Its Card + # stamps therefore retain the template token until an adopter's + # initial transaction supplies --set-version and creates state. + active_version = args.set_version or "{{ standards_version }}" if args.set_version and active_version and args.set_version != active_version: failures.append( "--set-version %r does not equal active standards_version %r in %s" diff --git a/Tools/standards_state.py b/Tools/standards_state.py new file mode 100644 index 0000000..41b3a21 --- /dev/null +++ b/Tools/standards_state.py @@ -0,0 +1,173 @@ +#!/usr/bin/env python3 +"""Canonical adopter Standards state. + +Kernel Markdown owns rules. This file format owns one adopter's current +Standards/Profile identity. Adoption history remains append-only receipt +evidence under ``.cambium/receipts/standards-adoptions.jsonl``. + +The public Cambium distribution intentionally carries no state file. An +adopter creates it through the initial R09 adoption transaction; ordinary +runtime consumers fail closed when it is absent. +""" + +import datetime +import os +import re +import sys + +sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) +import kblib + + +STATE_PATH = ".cambium/governance/standards_state.yaml" +SCHEMA_VERSION = 1 +STATE_FIELDS = frozenset(( + "schema_version", "state_revision", "standards_version", "status", + "effective_date", "selected_profile_manifest", + "latest_adoption_receipt", "upstream_source_ref", + "upstream_revision_id", +)) +SHA_RE = re.compile(r"sha256:[0-9a-f]{64}\Z") +RECEIPT_ID_RE = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]*\Z") + + +def _nonempty(value): + return isinstance(value, str) and bool(value.strip()) + + +def state_errors(state, *, allow_initial_receipt_null=False): + """Return closed-schema errors for one parsed state mapping.""" + if not isinstance(state, dict): + return ["Standards state top level must be a mapping"] + errors = [] + missing = sorted(STATE_FIELDS - set(state)) + extra = sorted(set(state) - STATE_FIELDS) + if missing: + errors.append("Standards state misses field(s): %s" % + ", ".join(missing)) + if extra: + errors.append("Standards state has unsupported field(s): %s" % + ", ".join(extra)) + if state.get("schema_version") != SCHEMA_VERSION: + errors.append("Standards state schema_version must be %d" % + SCHEMA_VERSION) + revision = state.get("state_revision") + if not isinstance(revision, int) or isinstance(revision, bool) or revision < 1: + errors.append("Standards state state_revision must be an integer >= 1") + for field in ("standards_version", "selected_profile_manifest"): + if not _nonempty(state.get(field)): + errors.append("Standards state %s must be non-empty" % field) + if state.get("status") != "approved": + errors.append("Standards state status must be approved") + date = state.get("effective_date") + if not _nonempty(date): + errors.append("Standards state effective_date must be YYYY-MM-DD") + else: + try: + parsed = datetime.date.fromisoformat(date) + except ValueError: + parsed = None + if parsed is None or parsed.isoformat() != date: + errors.append("Standards state effective_date must be YYYY-MM-DD") + manifest = state.get("selected_profile_manifest") + if (_nonempty(manifest) and + (not manifest.startswith("profiles/") or + not manifest.endswith("/profile.md") or + "//" in manifest or "/../" in manifest or "/./" in manifest)): + errors.append( + "Standards state selected_profile_manifest must be a canonical " + "profiles//profile.md path") + receipt = state.get("latest_adoption_receipt") + if receipt is None: + if not allow_initial_receipt_null: + errors.append("Standards state latest_adoption_receipt must be non-null") + elif not _nonempty(receipt) or not RECEIPT_ID_RE.fullmatch(receipt): + errors.append("Standards state latest_adoption_receipt is invalid") + upstream_source = state.get("upstream_source_ref") + upstream_revision = state.get("upstream_revision_id") + if (upstream_source is None) != (upstream_revision is None): + errors.append( + "Standards state upstream_source_ref and upstream_revision_id " + "must be both null or both non-null") + if upstream_source is not None and not _nonempty(upstream_source): + errors.append("Standards state upstream_source_ref must be non-empty") + if upstream_revision is not None and not _nonempty(upstream_revision): + errors.append("Standards state upstream_revision_id must be non-empty") + return errors + + +def parse(text, *, allow_initial_receipt_null=False): + state = kblib.parse_yaml_subset(text) + errors = state_errors( + state, allow_initial_receipt_null=allow_initial_receipt_null) + return state, errors + + +def canonical_text(state, *, allow_initial_receipt_null=False): + errors = state_errors( + state, allow_initial_receipt_null=allow_initial_receipt_null) + if errors: + raise ValueError("; ".join(errors)) + return kblib.canonical_yaml(state) + + +def snapshot(root, *, override_text=None, allow_initial_receipt_null=False): + """Return ``(state, view, errors)`` from exact state bytes. + + ``override_text`` is for an in-memory transaction after-image. It never + falls back to K00/03: legacy Markdown is migration input, not authority. + """ + root = os.path.realpath(os.path.abspath(os.fspath(root))) + if override_text is None: + try: + snap = kblib.repository_file_snapshot( + root, STATE_PATH, singly_linked=True) + text = snap.read_text() + digest = snap.sha256 + except (OSError, UnicodeError, ValueError) as exc: + return None, None, [ + "active Standards state %s is unsafe, absent, or unreadable: %s" + % (STATE_PATH, exc)] + else: + if not isinstance(override_text, str): + return None, None, ["active Standards state override must be text"] + text = override_text + digest = kblib.sha256_bytes(text) + try: + state, errors = parse( + text, allow_initial_receipt_null=allow_initial_receipt_null) + except (TypeError, ValueError, kblib.YamlSubsetError) as exc: + return None, None, ["active Standards state is malformed: %s" % exc] + if errors: + return None, None, errors + view = { + "active_standards_path": STATE_PATH, + "active_standards_sha256": digest, + "standards_version": state["standards_version"], + "selected_profile_manifest": state["selected_profile_manifest"], + "standards_status": state["status"], + "standards_effective_date": state["effective_date"], + "standards_state_revision": state["state_revision"], + "latest_adoption_receipt": state["latest_adoption_receipt"], + "upstream_source_ref": state["upstream_source_ref"], + "upstream_revision_id": state["upstream_revision_id"], + } + return state, view, [] + + +def next_state(before, *, standards_version, effective_date, + selected_profile_manifest, latest_adoption_receipt, + upstream_source_ref, upstream_revision_id): + """Construct the next canonical current-state record.""" + revision = 1 if before is None else before["state_revision"] + 1 + return { + "schema_version": SCHEMA_VERSION, + "state_revision": revision, + "standards_version": standards_version, + "status": "approved", + "effective_date": effective_date, + "selected_profile_manifest": selected_profile_manifest, + "latest_adoption_receipt": latest_adoption_receipt, + "upstream_source_ref": upstream_source_ref, + "upstream_revision_id": upstream_revision_id, + } diff --git a/Tools/tests/profile_fixture.py b/Tools/tests/profile_fixture.py index 992d492..805d1ef 100644 --- a/Tools/tests/profile_fixture.py +++ b/Tools/tests/profile_fixture.py @@ -16,6 +16,7 @@ import profile_contract # noqa: E402 (path set above) import kblib # noqa: E402 import metadata_execution_contract # noqa: E402 +import standards_state # noqa: E402 # Derived, never re-listed: `check_profile` refuses a repository whose # interface slot list and this registry disagree, so deriving the synthetic @@ -238,16 +239,20 @@ def install_loadable_profile(root, profile_id="test-profile", "kernel/K00 Standards Control/execution-defaults-base.yaml", defaults, ) - active = root / "kernel/K00 Standards Control/03 Standards Governance.md" + active = root / standards_state.STATE_PATH + active.parent.mkdir(parents=True, exist_ok=True) if not active.exists(): - active.write_text( - "# Standards Governance\n\n## Standards Control\n\n" - "| Field | Value |\n|---|---|\n" - "| Standards version | `%s` |\n" - "| Status | `approved` |\n" - "| Effective date | `2026-08-01` |\n" - "| Selected profile manifest | `profiles/%s/profile.md` |\n" % - (standards_version, profile_id), - encoding="utf-8") + active.write_text(standards_state.canonical_text({ + "schema_version": 1, + "state_revision": 1, + "standards_version": standards_version, + "status": "approved", + "effective_date": "2026-08-01", + "selected_profile_manifest": + "profiles/%s/profile.md" % profile_id, + "latest_adoption_receipt": "audit-fixture-standards-adoption", + "upstream_source_ref": None, + "upstream_revision_id": None, + }), encoding="utf-8") _install_runtime_activation_fixture(root) return profile diff --git a/Tools/tests/test_adopt_standards.py b/Tools/tests/test_adopt_standards.py index 86b0c1f..b8dfe2e 100644 --- a/Tools/tests/test_adopt_standards.py +++ b/Tools/tests/test_adopt_standards.py @@ -25,6 +25,7 @@ import check_vocab import kblib import seal_receipts +import standards_state import update_queue from profile_fixture import install_loadable_profile from test_update_queue import UpdateQueueTests @@ -43,14 +44,8 @@ def setUp(self): governance = self.root / self.GOVERNANCE governance.parent.mkdir(parents=True, exist_ok=True) governance.write_text( - "## Standards Control\n\n" - "| Field | Value |\n" - "|---|---|\n" - "| Standards version | `3.0.0` |\n" - "| Status | `approved` |\n" - "| Effective date | `2026-08-05` |\n" - "| Selected profile manifest | " - "`profiles/test-profile/profile.md` |\n", + "## Standards State And Adoption History\n\n" + "Adopter state is external to the Kernel.\n", encoding="utf-8", ) registry = (self.root / @@ -137,16 +132,8 @@ def open_b1_and_hold_for_revalidation(self): return gate["receipt_id"] def plan(self, *, invalidated_receipt=None, overrides=None): - # The live runtime starts aligned to approved 3.0. Publish the approved - # 3.1 governance after-image only when preparing its adoption; the - # writer's explicit mismatch escape is the sole bridge between them. - governance = self.root / self.GOVERNANCE - governance.write_text( - governance.read_text(encoding="utf-8").replace( - "| Standards version | `3.0.0` |", - "| Standards version | `3.1.0` |"), - encoding="utf-8", - ) + # The live adopter state starts aligned to approved 3.0. The plan + # proposes 3.1 while K00/03 remains an unchanged rules owner. queue = self.load(check_queue.QUEUE_PATH) progress = self.load(check_queue.PROGRESS_PATH) contract = progress["contract"] @@ -155,7 +142,7 @@ def plan(self, *, invalidated_receipt=None, overrides=None): self.root, queue["selected_profile_manifest"]) self.assertEqual([], profile_errors) plan = { - "schema_version": 1, + "schema_version": 2, "adoption_id": "SA-001", "task_id": queue["task_id"], "task_state_before": progress["task_state"], @@ -164,6 +151,9 @@ def plan(self, *, invalidated_receipt=None, overrides=None): contract["contract_version"], "standards_version_before": queue["standards_version"], "standards_version_after": "3.1.0", + "standards_effective_date_after": "2026-08-06", + "standards_state_sha256_before": kblib.sha256_file( + self.root / standards_state.STATE_PATH), "selected_profile_manifest_before": queue["selected_profile_manifest"], "selected_profile_manifest_after": @@ -249,6 +239,15 @@ def command(self, *, apply=False, actor="worker"): code = adopt_standards.main(args) return code, stdout.getvalue() + @staticmethod + def legacy_plan_shape(plan): + """Project a current plan onto the immutable pre-1.7 schema.""" + legacy = copy.deepcopy(plan) + legacy["schema_version"] = 1 + legacy.pop("standards_effective_date_after", None) + legacy.pop("standards_state_sha256_before", None) + return legacy + def test_a_contract_amendment_may_follow_an_adoption(self): """The other guarded contract writer must not be locked out. @@ -430,7 +429,7 @@ def test_state_write_failure_restores_before_bytes_and_records_abort(self): self.plan() paths = [self.root / path for path in ( check_queue.COVERAGE_PATH, check_queue.QUEUE_PATH, - check_queue.PROGRESS_PATH)] + check_queue.PROGRESS_PATH, standards_state.STATE_PATH)] before = [path.read_bytes() for path in paths] original = kblib.atomic_write_text state_writes = {"count": 0} @@ -458,8 +457,7 @@ def fail_second_state_write(path, text, validator=None): {adopt_standards.GATE_ID}, {row.get("gate_id") for row in rows}) ordinary_errors = check_queue.validate_runtime(self.root)["errors"] - self.assertTrue(any("differs from active K00/03" in error - for error in ordinary_errors), ordinary_errors) + self.assertEqual([], ordinary_errors) recovered = check_queue.validate_runtime( self.root, allow_invalid_current_profile_for_corrective_adoption=True, @@ -1055,7 +1053,7 @@ def test_pre_1_6_history_replays_raw_and_recorded_gate_union(self): # newly written, otherwise complete transaction as bytes an immutable # 1.5 producer would have left behind. plan_path = self.root / self.PLAN - legacy_plan = self.load(self.PLAN) + legacy_plan = self.legacy_plan_shape(self.load(self.PLAN)) legacy_plan["changed_predicates"][0][ "affected_gate_ids"] = raw_leaves legacy_plan["invalidation_boundaries"][0][ @@ -1125,8 +1123,9 @@ def test_1_6_history_keeps_its_recorded_owner_projection(self): encoding="utf-8") runtime = check_queue.validate_runtime(self.root) + legacy_plan = self.legacy_plan_shape(plan) historical = check_queue.standards_adoption_plan_errors( - self.root, plan, catalog=runtime["receipt_catalog"], + self.root, legacy_plan, catalog=runtime["receipt_catalog"], queue=runtime["queue"], progress=runtime["progress"], validate_current=False, producer_tool_version="1.6.0") self.assertEqual([], historical) @@ -2594,6 +2593,28 @@ def rewrite_adoption_receipts(self, **field_overrides): to satisfy a constant that moved after they were written; the fixture edits them only to stand in for bytes a past producer left behind. """ + rewritten_adopt_version = field_overrides.get( + "tool_version", {}).get(adopt_standards.TOOL) + legacy_plan_sha = None + legacy_progress_sha = None + immediate_receipts = set() + if (isinstance(rewritten_adopt_version, str) and + tuple(int(part) for part in + rewritten_adopt_version.split(".")) < (1, 7, 0)): + plan_path = self.root / self.PLAN + legacy_plan = self.legacy_plan_shape(self.load(self.PLAN)) + plan_path.write_text( + kblib.canonical_yaml(legacy_plan), encoding="utf-8") + legacy_plan_sha = kblib.sha256_file(plan_path) + progress_path = self.root / check_queue.PROGRESS_PATH + progress = self.load(check_queue.PROGRESS_PATH) + record = progress["standards_adoptions"][-1] + record["plan_sha256"] = legacy_plan_sha + immediate_receipts.update(record["immediate_gate_receipts"]) + progress_path.write_text( + kblib.canonical_yaml(progress), encoding="utf-8") + legacy_progress_sha = kblib.sha256_file(progress_path) + receipt_path = self.root / self.RECEIPTS rows = [json.loads(line) for line in receipt_path.read_text( encoding="utf-8").splitlines() if line.strip()] @@ -2601,6 +2622,12 @@ def rewrite_adoption_receipts(self, **field_overrides): for field, by_tool in field_overrides.items(): if row.get("tool") in by_tool: row[field] = by_tool[row["tool"]] + if (legacy_plan_sha is not None and + row.get("tool") == adopt_standards.TOOL): + row["plan_sha256"] = legacy_plan_sha + row["after_progress_sha256"] = legacy_progress_sha + if row.get("receipt_id") in immediate_receipts: + row["progress_ledger_sha256"] = legacy_progress_sha receipt_path.write_text( "".join(json.dumps(row, separators=(",", ":")) + "\n" for row in rows), encoding="utf-8") @@ -2672,7 +2699,7 @@ def test_pre_1_3_profile_change_replays_without_new_profile_bindings(self): # contract. The state transition and selected after Profile stay the # same; only fields and boundary declarations 1.2 never promised are # absent. - legacy_plan = self.load(self.PLAN) + legacy_plan = self.legacy_plan_shape(self.load(self.PLAN)) legacy_plan.pop("profile_contract_fingerprint_after") legacy_plan.pop("profile_load_inputs_sha256_after") legacy_plan["changed_predicates"] = [] @@ -2742,7 +2769,7 @@ def test_pre_1_4_history_replays_without_profile_load_input_binding(self): self.commit_one_adoption() plan_path = self.root / self.PLAN - legacy_plan = self.load(self.PLAN) + legacy_plan = self.legacy_plan_shape(self.load(self.PLAN)) legacy_plan.pop("profile_load_inputs_sha256_after") plan_path.write_text( kblib.canonical_yaml(legacy_plan), encoding="utf-8") @@ -2849,11 +2876,12 @@ def test_an_adoption_receipt_era_nothing_accounts_for_is_refused(self): errors = self.rewrite_adoption_receipts( tool_version={adopt_standards.TOOL: "1.1.0"}, standards_version={adopt_standards.TOOL: "9.9.9"}) - self.assertEqual(1, len(errors), errors) - self.assertIn("commit receipt", errors[0]) - self.assertIn("claims standards_version='9.9.9'", errors[0]) + era_errors = [error for error in errors + if "claims standards_version='9.9.9'" in error] + self.assertEqual(1, len(era_errors), errors) + self.assertIn("commit receipt", era_errors[0]) self.assertIn("no Standards adoption record or live identity", - errors[0]) + era_errors[0]) def test_the_accounted_era_set_is_the_instance_own_adoption_chain(self): """Both ends of every recorded step, plus the live identity.""" diff --git a/Tools/tests/test_apply_profile_adoption.py b/Tools/tests/test_apply_profile_adoption.py index 88b87cd..f29e60f 100644 --- a/Tools/tests/test_apply_profile_adoption.py +++ b/Tools/tests/test_apply_profile_adoption.py @@ -1,22 +1,21 @@ -"""`Tools/apply_profile_adoption.py` — the no-runtime R09 adoption writer. +"""`Tools/apply_profile_adoption.py` — the no-task-runtime R09 writer. -The writer is the sibling of `adopt_standards.py` for the case where no -`.cambium/` runtime exists: initial adoption instantiates the four K00/03 -Standards Control placeholders and creates the first Change Summary row; a -pre-runtime profile revision updates the cells and appends a second row. -Both branches then drive the existing producers (`compose_vocab`, -`compose_page_contract`, `stamp_cards --set-version`, `stamp_cards --check`) -against the new K00/03 state. This module pins the transaction's safety -contract: +The writer is the sibling of `adopt_standards.py`: initial adoption creates +the canonical adopter Standards state, while a pre-runtime Profile revision +advances it. Both branches append immutable receipt history and drive the +existing producers (`compose_vocab`, `compose_page_contract`, +`stamp_cards --set-version`, `stamp_cards --check`) against the new state. +K00/03 remains unchanged normative governance. This module pins the +transaction's safety contract: 1. dry-run writes nothing anywhere (tree byte-hash unchanged, no staging directory) and reports the complete planned change; -2. both happy paths leave the exact promised state: cells instantiated, - Change Summary rows appended and preserved, vocab.yaml/page_contract.yaml - composed, cards stamped, `stamp_cards --check` exit 0, two receipts +2. both happy paths leave the exact promised state: canonical state advanced, + receipt history appended, vocab.yaml/page_contract.yaml composed, Cards + stamped, `stamp_cards --check` exit 0, two receipts appended (the canonical `profile-load` pass receipt plus the commit receipt, which registers no Gate ID of its own); -3. every refusal (existing `.cambium/` anywhere, K00/03 drift, candidate +3. every refusal (existing task runtime, K00/03 drift, candidate byte drift, failing profile-load, nonempty changed_predicates, branch / state mismatch) performs zero writes; 4. an injected mid-transaction failure restores every touched byte (tree @@ -54,6 +53,7 @@ import apply_profile_adoption # noqa: E402 import check_profile # noqa: E402 import kblib # noqa: E402 +import standards_state # noqa: E402 import test_profile_onboarding_status as tpos # noqa: E402 import test_template_fill # noqa: E402 (reused semantic fill + scan config) @@ -134,7 +134,7 @@ def evaluation_of(root): def initial_plan(root, **overrides): evaluation = evaluation_of(root) plan = { - "schema_version": 1, + "schema_version": 2, "plan_id": "PA-001", "branch": "initial-adoption", "standards_version_after": "1.0.0", @@ -149,6 +149,9 @@ def initial_plan(root, **overrides): "changed_predicates": [], "adoption_requirement": "none", "k00_03_sha256_before": kblib.sha256_file(root / GOVERNANCE), + "standards_state_sha256_before": None, + "upstream_source_ref": "https://example.test/corpus.git", + "upstream_revision_id": "0123456789abcdef", "profile_snapshot_sha256_after": evaluation.profile_snapshot_sha256, "profile_contract_fingerprint_after": evaluation.profile_contract_fingerprint, @@ -168,6 +171,10 @@ def revision_plan(root, **overrides): "standards_effective_date_after": "2026-08-14", "standards_version_before": "1.0.0", "selected_profile_manifest_before": MANIFEST, + "standards_state_sha256_before": ( + kblib.sha256_file(root / standards_state.STATE_PATH) + if (root / standards_state.STATE_PATH).exists() + else "sha256:" + "0" * 64), "change_summary": "Profile revision inside %s: corpus-planning " "reason updated" % MANIFEST, }) @@ -225,23 +232,19 @@ def journal_of(root, staging_name): def governance_state(root): - state, errors = kblib.active_standards_state( - (root / GOVERNANCE).read_text(encoding="utf-8")) + state, _view, errors = standards_state.snapshot(root) assert not errors, errors return state def change_summary_rows(root): - lines = (root / GOVERNANCE).read_text(encoding="utf-8").splitlines() - index = lines.index( - "| Version | Date | Change | Changed predicates " - "| Adoption requirement |") - rows = [] - for line in lines[index + 2:]: - if not line.startswith("|"): - break - rows.append(line) - return rows + path = root / ".cambium/receipts/standards-adoptions.jsonl" + if not path.exists(): + return [] + return [json.loads(line) for line in path.read_text( + encoding="utf-8").splitlines() + if line.strip() and json.loads(line).get("tool") == + "apply_profile_adoption"] def mutate_candidate(root): @@ -282,7 +285,7 @@ def test_dry_run_writes_nothing_and_reports_the_planned_change(self): plan["profile_snapshot_sha256_after"], plan["profile_contract_fingerprint_after"], plan["profile_load_inputs_sha256_after"], - "Change Summary row:", "compose-vocab", "stamp-check", + "history: append one transaction record", "compose-vocab", "stamp-check", "dry run"): self.assertIn(expected, out) @@ -298,13 +301,12 @@ def test_initial_adoption_happy_path(self): state = governance_state(root) self.assertEqual("1.0.0", state["standards_version"]) - self.assertEqual("approved", state["standards_status"]) - self.assertEqual("2026-08-13", state["standards_effective_date"]) + self.assertEqual("approved", state["status"]) + self.assertEqual("2026-08-13", state["effective_date"]) self.assertEqual(MANIFEST, state["selected_profile_manifest"]) rows = change_summary_rows(root) self.assertEqual(1, len(rows)) - self.assertIn("Initial adoption", rows[0]) - self.assertIn("| none | none |", rows[0]) + self.assertIn("Initial adoption", rows[0]["change_summary"]) self.assertTrue((root / "Tools" / "vocab.yaml").is_file()) self.assertTrue((root / "Tools" / "page_contract.yaml").is_file()) @@ -320,7 +322,7 @@ def test_initial_adoption_happy_path(self): receipts = [ json.loads(line) for line in - (root / "adoption-plans" / "PA-001.receipts.jsonl") + (root / ".cambium/receipts/standards-adoptions.jsonl") .read_text(encoding="utf-8").splitlines()] self.assertEqual(2, len(receipts)) gate, commit = receipts @@ -349,9 +351,9 @@ def test_initial_adoption_happy_path(self): "profile_load_inputs_sha256_after"): self.assertEqual(plan[field], commit[field]) - # Hard prohibitions: no runtime appears, the candidate Profile is + # Hard prohibitions: no task runtime appears, the candidate Profile is # byte-untouched, and the staging directory is gone. - self.assertFalse((root / ".cambium").exists()) + self.assertFalse((root / ".cambium/state").exists()) self.assertEqual(profile_before, tree_state(root / "profiles" / PROFILE_ID)) self.assertEqual([], stagings(root)) @@ -368,13 +370,13 @@ def test_profile_revision_happy_path(self): state = governance_state(root) self.assertEqual("1.1.0", state["standards_version"]) - self.assertEqual("2026-08-14", state["standards_effective_date"]) + self.assertEqual("2026-08-14", state["effective_date"]) self.assertEqual(MANIFEST, state["selected_profile_manifest"]) rows = change_summary_rows(root) self.assertEqual(2, len(rows)) - self.assertEqual(first_rows[0], rows[0], - "the first Change Summary row must be preserved") - self.assertIn("Profile revision", rows[1]) + self.assertEqual(first_rows[0]["receipt_id"], rows[0]["receipt_id"], + "the first adoption receipt must be preserved") + self.assertIn("Profile revision", rows[1]["change_summary"]) card = (root / "kernel" / "Cards" / "R09 Standards Governance Card.md").read_text( encoding="utf-8") @@ -386,7 +388,7 @@ def test_profile_revision_happy_path(self): self.assertEqual(0, check.returncode, check.stdout) self.assertEqual(profile_before, tree_state(root / "profiles" / PROFILE_ID)) - self.assertFalse((root / ".cambium").exists()) + self.assertFalse((root / ".cambium/state").exists()) # ---- refusals (zero writes) -------------------------------------- @@ -446,13 +448,13 @@ def test_branch_state_mismatch_is_refused_both_ways(self): adopted = self.clone(_ADOPTED) write_plan(adopted, initial_plan(adopted), "adoption-plans/PA-003.yaml") - self.assert_refused(adopted, "already instantiated", + self.assert_refused(adopted, "current state already exists", plan="adoption-plans/PA-003.yaml") pristine = self.clone() plan = revision_plan(pristine) write_plan(pristine, plan, "adoption-plans/PA-004.yaml") - self.assert_refused(pristine, "still placeholders", + self.assert_refused(pristine, "requires an existing adopter", plan="adoption-plans/PA-004.yaml") # ---- abort and recovery ------------------------------------------ @@ -475,6 +477,9 @@ def failing(command, cwd): self.assertIn("restored", out) self.assertEqual(before, tree_state(root), "abort must leave the repository byte-identical") + self.assertFalse( + (root / ".cambium").exists(), + "aborted initial adoption must not leave an empty namespace") names = stagings(root) self.assertEqual(1, len(names)) journal = journal_of(root, names[0]) diff --git a/Tools/tests/test_check_queue.py b/Tools/tests/test_check_queue.py index e314776..fd53ff8 100644 --- a/Tools/tests/test_check_queue.py +++ b/Tools/tests/test_check_queue.py @@ -19,6 +19,7 @@ import check_queue import kblib +import standards_state from profile_fixture import install_loadable_profile @@ -50,12 +51,12 @@ def queue(self): def test_runtime_identity_must_match_approved_active_standards(self): baseline = check_queue.validate_runtime(self.root) self.assertEqual([], baseline["errors"]) - active = ( - self.root / - "kernel/K00 Standards Control/03 Standards Governance.md") - text = active.read_text(encoding="utf-8") + active = self.root / standards_state.STATE_PATH + state = kblib.load_yaml_file(active) + state["standards_version"] = "9.9.9" + state["state_revision"] += 1 active.write_text( - text.replace("`3.0.0`", "`9.9.9`", 1), encoding="utf-8") + standards_state.canonical_text(state), encoding="utf-8") result = check_queue.validate_runtime(self.root) @@ -1645,9 +1646,10 @@ def test_runtime_rejects_stale_injected_active_standards_view(self): self.assertEqual([], initial["errors"]) authority = check_queue.runtime_authority_context(initial) active = self.root / check_queue.ACTIVE_STANDARDS_PATH + state = kblib.load_yaml_file(active) + state["state_revision"] += 1 active.write_text( - active.read_text(encoding="utf-8") + - "\n\n", + standards_state.canonical_text(state), encoding="utf-8") with mock.patch.object( @@ -1661,7 +1663,7 @@ def test_runtime_rejects_stale_injected_active_standards_view(self): load.assert_not_called() self.assertIn( - "active Standards Control changed after identity admission", + "active Standards state changed after identity admission", "; ".join(rebound["errors"])) def test_runtime_rejects_stale_injected_profile_view_without_rerun(self): @@ -4197,7 +4199,10 @@ def test_two_explicit_concurrency_cap_overrides_must_agree(self): self.assertEqual(1, conflicting.returncode, conflicting.stdout) self.assertIn("contradicts the selected profile manifest's registered " "concurrency_cap 5", conflicting.stdout) - self.assertFalse((fresh / ".cambium").exists()) + self.assertTrue( + (fresh / standards_state.STATE_PATH).is_file(), + "failed task initialization preserves pre-runtime governance") + self.assertFalse((fresh / ".cambium/state").exists()) agreeing = self.run_init(fresh, "--concurrency-cap", "5") self.assertEqual(0, agreeing.returncode, agreeing.stdout) self.assertIn("concurrency_cap=5 (resolved from " @@ -4214,7 +4219,9 @@ def test_unusable_profile_concurrency_cap_fails_closed(self): completed.stdout) self.assertIn("override-value-domain", completed.stdout) self.assertIn("expected a positive integer", completed.stdout) - self.assertFalse((fresh / ".cambium").exists()) + self.assertTrue( + (fresh / standards_state.STATE_PATH).is_file()) + self.assertFalse((fresh / ".cambium/state").exists()) def test_init_creates_empty_state_without_fake_work_and_refuses_overwrite(self): fresh = Path(self.tmp.name) / "fresh" diff --git a/Tools/tests/test_migrate_standards_state.py b/Tools/tests/test_migrate_standards_state.py new file mode 100644 index 0000000..5e210e0 --- /dev/null +++ b/Tools/tests/test_migrate_standards_state.py @@ -0,0 +1,80 @@ +import json +from pathlib import Path +import shutil +import sys +import tempfile +import unittest + + +TOOLS = Path(__file__).resolve().parents[1] +FIXTURE = TOOLS / "tests" / "fixtures" / "runtime_state" / "valid" +sys.path.insert(0, str(TOOLS / "tests")) +sys.path.insert(0, str(TOOLS)) + +import kblib +import migrate_standards_state +import standards_state +from profile_fixture import install_loadable_profile + + +class MigrateStandardsStateTests(unittest.TestCase): + def setUp(self): + self.tmp = tempfile.TemporaryDirectory() + self.root = Path(self.tmp.name) / "repo" + shutil.copytree(FIXTURE, self.root) + install_loadable_profile(self.root) + (self.root / standards_state.STATE_PATH).unlink() + receipt = { + "receipt_id": "audit-adopt-3.0.0", + "tool": "adopt_standards", + "tool_version": "1.6.0", + "transaction_phase": "commit", + "result": "pass", + "standards_version_after": "3.0.0", + "checked_at": "2026-08-01T12:00:00Z", + "upstream_source_ref": "https://example.test/cambium.git", + "upstream_revision_id": "abc123", + } + path = self.root / migrate_standards_state.HISTORY_PATH + path.parent.mkdir(parents=True, exist_ok=True) + path.write_text(json.dumps(receipt) + "\n", encoding="utf-8") + + def tearDown(self): + self.tmp.cleanup() + + def test_apply_projects_live_identity_without_rewriting_history(self): + history = self.root / migrate_standards_state.HISTORY_PATH + before = history.read_bytes() + + self.assertEqual( + 0, migrate_standards_state.main([str(self.root), "--apply"])) + + state = kblib.load_yaml_file( + self.root / standards_state.STATE_PATH) + self.assertEqual("3.0.0", state["standards_version"]) + self.assertEqual("profiles/test-profile/profile.md", + state["selected_profile_manifest"]) + self.assertEqual("audit-adopt-3.0.0", + state["latest_adoption_receipt"]) + self.assertEqual("2026-08-01", state["effective_date"]) + self.assertEqual(before, history.read_bytes()) + + def test_ledgers_must_agree(self): + queue_path = self.root / migrate_standards_state.QUEUE_PATH + queue = kblib.load_yaml_file(queue_path) + queue["standards_version"] = "9.9.9" + queue_path.write_text(kblib.canonical_yaml(queue), encoding="utf-8") + + self.assertEqual(1, migrate_standards_state.main([str(self.root)])) + self.assertFalse((self.root / standards_state.STATE_PATH).exists()) + + def test_live_version_requires_committed_history(self): + (self.root / migrate_standards_state.HISTORY_PATH).write_text( + "", encoding="utf-8") + + self.assertEqual(1, migrate_standards_state.main([str(self.root)])) + self.assertFalse((self.root / standards_state.STATE_PATH).exists()) + + +if __name__ == "__main__": + unittest.main() diff --git a/Tools/tests/test_profile_admission.py b/Tools/tests/test_profile_admission.py index ece9f40..445a513 100644 --- a/Tools/tests/test_profile_admission.py +++ b/Tools/tests/test_profile_admission.py @@ -13,6 +13,7 @@ sys.path.insert(0, str(TOOLS)) import profile_admission +import standards_state from Tools.tests.profile_fixture import install_loadable_profile @@ -25,21 +26,19 @@ def setUp(self): self.profile = install_loadable_profile(self.root) def install_active_state(self): - source = ( - REPOSITORY / - "kernel/K00 Standards Control/03 Standards Governance.md" - ) - target = self.root / source.relative_to(REPOSITORY) + target = self.root / standards_state.STATE_PATH target.parent.mkdir(parents=True, exist_ok=True) - text = source.read_text(encoding="utf-8") - for old, new in ( - ("{{ standards_version }}", "1.0.0"), - ("{{ standards_status }}", "approved"), - ("{{ standards_effective_date }}", "2026-08-11"), - ("{{ selected_profile_manifest }}", - "profiles/test-profile/profile.md")): - text = text.replace(old, new) - target.write_text(text, encoding="utf-8") + target.write_text(standards_state.canonical_text({ + "schema_version": 1, + "state_revision": 1, + "standards_version": "1.0.0", + "status": "approved", + "effective_date": "2026-08-11", + "selected_profile_manifest": "profiles/test-profile/profile.md", + "latest_adoption_receipt": "audit-profile-admission-fixture", + "upstream_source_ref": None, + "upstream_revision_id": None, + }), encoding="utf-8") return target def test_one_evaluation_supplies_all_typed_slot_bytes(self): @@ -100,7 +99,7 @@ def mutate_after_evaluation(*args, **kwargs): evaluation = real(*args, **kwargs) state.write_text( state.read_text(encoding="utf-8").replace( - "| Status | `approved` |", "| Status | `draft` |"), + "status: approved", "status: draft"), encoding="utf-8") return evaluation @@ -118,7 +117,7 @@ def test_active_state_change_invalidates_admitted_selection(self): self.assertEqual([], errors) state.write_text( state.read_text(encoding="utf-8").replace( - "| Status | `approved` |", "| Status | `draft` |"), + "status: approved", "status: draft"), encoding="utf-8") self.assertIn("active Standards state changed", "\n".join(profile_admission.currency_errors( @@ -131,7 +130,7 @@ def test_active_state_hard_link_is_not_an_admissible_selection_source(self): admission, errors = profile_admission.admit_profile(self.root) self.assertIsNone(admission) - self.assertIn("cannot read the active Standards state", + self.assertIn("unsafe, absent, or unreadable", "\n".join(errors)) def test_canonical_profile_load_input_change_invalidates_admission(self): diff --git a/Tools/tests/test_profile_onboarding_status.py b/Tools/tests/test_profile_onboarding_status.py index db74824..27eebdc 100644 --- a/Tools/tests/test_profile_onboarding_status.py +++ b/Tools/tests/test_profile_onboarding_status.py @@ -1,7 +1,7 @@ """`Tools/profile_onboarding_status.py` — the read-only status projector. The projector derives one onboarding view and exactly one `next_action` -token from bytes owned elsewhere (K00/03, profiles/, the corpus tree, +token from bytes owned elsewhere (adopter Standards state, profiles/, the corpus tree, `.cambium/`). This module pins the full decision table over temp-root fixtures, that the tool degrades gracefully off a Cambium root, that its `--json` output is deterministic, and — because a status *projector* that @@ -34,6 +34,7 @@ import kblib # noqa: E402 import metadata_execution_contract # noqa: E402 import scaffold_profile # noqa: E402 +import standards_state # noqa: E402 import test_template_fill # noqa: E402 (reused semantic fill + scan config) # Extra root-owned inputs used by this onboarding fixture outside the @@ -121,20 +122,23 @@ def fill_candidate(root, profile_id=FILLED_ID): def adopt(root, manifest_relative, fields=None): - """Instantiate K00/03's four placeholders (or the subset in fields).""" + """Materialize canonical state, optionally omitting fields for a fault.""" values = { + "schema_version": 1, + "state_revision": 1, "standards_version": "adopt-v1", - "standards_status": "approved", - "standards_effective_date": "2026-08-13", + "status": "approved", + "effective_date": "2026-08-13", "selected_profile_manifest": manifest_relative, + "latest_adoption_receipt": "audit-fixture-adoption", + "upstream_source_ref": None, + "upstream_revision_id": None, } - path = root / K00_03_RELATIVE - text = path.read_text(encoding="utf-8") - for field in (fields if fields is not None else sorted(values)): - placeholder = "{{ %s }}" % field - assert placeholder in text, field - text = text.replace(placeholder, values[field]) - path.write_text(text, encoding="utf-8") + if fields is not None: + values = {field: values[field] for field in fields} + path = root / standards_state.STATE_PATH + path.parent.mkdir(parents=True, exist_ok=True) + path.write_text(kblib.canonical_yaml(values), encoding="utf-8") def tree_state(root): @@ -257,8 +261,8 @@ def test_empty_corpus_asks_for_bounded_founding(self): self.assertEqual("adopted", view["standards_state"]) self.assertEqual( {"standards_version": "adopt-v1", - "standards_status": "approved", - "standards_effective_date": "2026-08-13", + "status": "approved", + "effective_date": "2026-08-13", "selected_profile_manifest": "profiles/%s/profile.md" % FILLED_ID}, view["standards_values"]) @@ -342,13 +346,14 @@ def test_cambium_runtime_beats_every_other_state(self): self.assertTrue(any("--resume-status" in note for note in view["notes"])) - def test_empty_cambium_directory_still_wins(self): + def test_governance_only_namespace_is_not_a_task_runtime(self): with tempfile.TemporaryDirectory() as tmp: root = make_root(tmp) (root / ".cambium").mkdir() code, view, _ = run_status_json(root) self.assertEqual(0, code) - self.assertEqual("resume-existing-task", view["next_action"]) + self.assertEqual("confirm-profile-identity", view["next_action"]) + self.assertFalse(view["cambium_runtime"]["present"]) self.assertFalse(view["cambium_runtime"]["state_has_content"]) @@ -357,23 +362,23 @@ def test_partial_instantiation_is_inconsistent(self): with tempfile.TemporaryDirectory() as tmp: root = make_root(tmp) adopt(root, "profiles/x/profile.md", - fields=("standards_version", "standards_status")) + fields=("schema_version", "standards_version")) code, view, _ = run_status_json(root) self.assertEqual(0, code) self.assertEqual("inconsistent", view["standards_state"]) - self.assertEqual( - ["selected_profile_manifest", "standards_effective_date"], - view["standards_uninstantiated"]) + self.assertEqual([], view["standards_uninstantiated"]) self.assertEqual("repair-control-state", view["next_action"]) self.assertTrue(any( - "selected_profile_manifest" in note and - "standards_effective_date" in note + "misses field(s)" in note and + "selected_profile_manifest" in note for note in view["notes"])) def test_unreadable_control_file_is_inconsistent(self): with tempfile.TemporaryDirectory() as tmp: root = make_root(tmp) - (root / K00_03_RELATIVE).unlink() + path = root / standards_state.STATE_PATH + path.parent.mkdir(parents=True, exist_ok=True) + path.mkdir() code, view, _ = run_status_json(root) self.assertEqual(0, code) self.assertEqual("inconsistent", view["standards_state"]) diff --git a/Tools/tests/test_queue_proof.py b/Tools/tests/test_queue_proof.py index 4ab2ca7..a3f6cb4 100644 --- a/Tools/tests/test_queue_proof.py +++ b/Tools/tests/test_queue_proof.py @@ -21,54 +21,36 @@ import check_proof import kblib +import standards_state import test_required_queue_e2e as required_queue_e2e -def materialize_synthetic_standards_state(document, profile_manifest): - """Set fixture-owned active state in a generic or instantiated K00/03.""" - - replacements = ( - ("Standards version", SYNTHETIC_STANDARDS_VERSION), - ("Status", "approved"), - ("Effective date", "2026-08-04"), - ("Selected profile manifest", profile_manifest), - ) - for field, value in replacements: - pattern = r"(?m)^\| %s \| .* \|$" % re.escape(field) - document, count = re.subn( - pattern, - "| %s | `%s` |" % (field, value), - document, - ) - if count != 1: - raise AssertionError( - "expected exactly one %s row in synthetic K00/03, found %d" - % (field, count) - ) - return document +def materialize_synthetic_standards_state(profile_manifest): + """Render the fixture-owned canonical adopter Standards state.""" + return standards_state.canonical_text({ + "schema_version": 1, + "state_revision": 1, + "standards_version": SYNTHETIC_STANDARDS_VERSION, + "status": "approved", + "effective_date": "2026-08-04", + "selected_profile_manifest": profile_manifest, + "latest_adoption_receipt": "audit-fixture-standards-adoption", + "upstream_source_ref": None, + "upstream_revision_id": None, + }) class ActiveStandardsFixtureTests(unittest.TestCase): - def test_materializer_replaces_populated_adopter_state(self): - source = """\ -| Field | Value | -|---|---| -| Standards version | `9.9.9` | -| Status | `superseded` | -| Effective date | `2099-01-01` | -| Selected profile manifest | `profiles/other/profile.md` | -""" + def test_materializer_renders_canonical_adopter_state(self): rendered = materialize_synthetic_standards_state( - source, "profiles/test-profile/profile.md" + "profiles/test-profile/profile.md" ) - self.assertIn( - "| Standards version | `3.2.0` |", rendered - ) - self.assertIn("| Status | `approved` |", rendered) - self.assertIn( - "| Selected profile manifest | " - "`profiles/test-profile/profile.md` |", - rendered, + parsed = kblib.parse_yaml_subset(rendered) + self.assertEqual("3.2.0", parsed["standards_version"]) + self.assertEqual("approved", parsed["status"]) + self.assertEqual( + "profiles/test-profile/profile.md", + parsed["selected_profile_manifest"], ) diff --git a/Tools/tests/test_required_queue_e2e.py b/Tools/tests/test_required_queue_e2e.py index f38b304..bca13a8 100644 --- a/Tools/tests/test_required_queue_e2e.py +++ b/Tools/tests/test_required_queue_e2e.py @@ -23,6 +23,7 @@ import metadata_execution_contract import metadata_property_state import project_page_state +import standards_state from profile_fixture import install_loadable_profile @@ -552,25 +553,20 @@ def install_terminal_proof_environment(self): (tools_root / "schemas").mkdir(parents=True, exist_ok=True) for name in ("check_profile.py", "profile_contract.py", "check_residual_content.py", "check_queue.py", "kblib.py", - "maintenance_candidates.py"): + "maintenance_candidates.py", "standards_state.py"): shutil.copy2(TOOLS / name, tools_root / name) shutil.copy2( TOOLS / "schemas/execution_defaults.template.yaml", tools_root / "schemas/execution_defaults.template.yaml") manifest = "profiles/test-profile/profile.md" - active_path = ( - self.root / - "kernel/K00 Standards Control/03 Standards Governance.md" - ) - active = active_path.read_text(encoding="utf-8") - for placeholder, value in ( - ("{{ standards_version }}", "3.0.0"), - ("{{ standards_status }}", "approved"), - ("{{ standards_effective_date }}", "2026-08-04"), - ("{{ selected_profile_manifest }}", manifest)): - active = active.replace(placeholder, value) - active_path.write_text(active, encoding="utf-8") + active_path = self.root / standards_state.STATE_PATH + active, _view, errors = standards_state.snapshot(self.root) + self.assertEqual([], errors) + active = dict(active) + active["selected_profile_manifest"] = manifest + active_path.write_text( + standards_state.canonical_text(active), encoding="utf-8") coverage_path = self.root / check_queue.COVERAGE_PATH queue_path = self.root / check_queue.QUEUE_PATH diff --git a/Tools/tests/test_runtime_safety.py b/Tools/tests/test_runtime_safety.py index 5248130..79e30a1 100644 --- a/Tools/tests/test_runtime_safety.py +++ b/Tools/tests/test_runtime_safety.py @@ -3,6 +3,7 @@ import io import os from pathlib import Path +import shutil import subprocess import sys import tempfile @@ -389,6 +390,9 @@ def run_main(self): code = init_state.main(self.command()[2:]) return code, output.getvalue() + def assert_no_task_runtime(self): + self.assertFalse((self.root / ".cambium/state").exists()) + def poison_profile_closure(self): slots = self.root / "profiles/sample/slots.md" owned = "profiles/sample/slots.md#Synthetic Predicate" @@ -423,7 +427,7 @@ def test_requested_runtime_identity_must_match_active_standards(self): stderr=subprocess.STDOUT, check=False) self.assertEqual(1, completed.returncode, completed.stdout) self.assertIn(expected, completed.stdout) - self.assertFalse((self.root / ".cambium").exists()) + self.assert_no_task_runtime() def test_a_manifest_override_row_is_read_and_frozen(self): self.write_overrides("| `concurrency_cap` | `8` |\n") @@ -486,7 +490,7 @@ def test_initialization_stops_on_a_malformed_override_row(self): self.assertIn("selected Profile failed profile-load", completed.stdout) self.assertIn("override-row-shape", completed.stdout) self.assertNotIn("concurrency_cap=3", completed.stdout) - self.assertFalse((self.root / ".cambium").exists()) + self.assert_no_task_runtime() def test_competing_initializers_publish_exactly_one_complete_tree(self): first = subprocess.Popen( @@ -504,7 +508,8 @@ def test_competing_initializers_publish_exactly_one_complete_tree(self): runtime = self.root / ".cambium" self.assertEqual( - {"state", "work_specs", "deltas", "receipts", "reports", "tmp"}, + {"state", "work_specs", "deltas", "receipts", "reports", "tmp", + "governance"}, {entry.name for entry in runtime.iterdir()}, ) state_names = {entry.name for entry in (runtime / "state").iterdir()} @@ -517,20 +522,20 @@ def test_competing_initializers_publish_exactly_one_complete_tree(self): self.assertEqual([], list(self.root.glob(".cambium-init-*"))) def test_profile_drift_before_publication_leaves_no_runtime(self): - real_publish = init_state.publish_runtime + real_publish = init_state.publish_runtime_into_governance_namespace def poison_before_publish(*args, **kwargs): self.poison_profile_closure() return real_publish(*args, **kwargs) with mock.patch.object( - init_state, "publish_runtime", + init_state, "publish_runtime_into_governance_namespace", side_effect=poison_before_publish): code, output = self.run_main() self.assertEqual(1, code, output) self.assertIn("pre-publication selected Profile failed", output) - self.assertFalse((self.root / ".cambium").exists()) + self.assert_no_task_runtime() self.assertEqual([], list(self.root.glob(".cambium-init-*"))) def test_profile_drift_after_publication_is_atomically_rolled_back(self): @@ -549,9 +554,9 @@ def poison_after_publication(source, destination): code, output = self.run_main() self.assertEqual(1, code, output) - self.assertEqual(2, calls["count"]) + self.assertEqual(12, calls["count"]) self.assertIn("post-publication selected Profile failed", output) - self.assertFalse((self.root / ".cambium").exists()) + self.assert_no_task_runtime() self.assertEqual([], list(self.root.glob(".cambium-init-*"))) def test_failed_postpublication_rollback_leaves_recovery_lock(self): @@ -581,6 +586,7 @@ def fail_rollback_after_profile_drift(source, destination): self.assertEqual([], list(self.root.glob(".cambium-init-*"))) def test_changed_initialization_lock_owner_is_never_released(self): + shutil.rmtree(self.root / ".cambium") documents = { "coverage_ledger.yaml": "schema_version: 1\n", "required_queue.yaml": "schema_version: 1\n", @@ -616,6 +622,7 @@ def replace_owner_operation(): self.assertEqual("different-task", persisted["operation"]["task_id"]) def test_staging_write_failure_leaves_no_runtime_or_staging_tree(self): + shutil.rmtree(self.root / ".cambium") arguments = SimpleNamespace( task_id="new-task", scope_version="s1", standards_version="3.0.0", profile_manifest="profiles/sample/profile.md", at="2026-08-04T00:00:00Z", @@ -639,10 +646,11 @@ def fail_second(path, text, validator=None): with self.assertRaisesRegex(OSError, "injected staging failure"): init_state.publish_runtime(str(self.root), documents) - self.assertFalse((self.root / ".cambium").exists()) + self.assert_no_task_runtime() self.assertEqual([], list(self.root.glob(".cambium-init-*"))) def test_empty_runtime_winning_publication_race_is_never_replaced(self): + shutil.rmtree(self.root / ".cambium") arguments = SimpleNamespace( task_id="new-task", scope_version="s1", standards_version="3.0.0", profile_manifest="profiles/sample/profile.md", @@ -679,7 +687,7 @@ def test_invalid_timestamp_is_rejected_before_publication(self): ) self.assertEqual(1, completed.returncode, completed.stdout) self.assertIn("timezone-aware RFC 3339", completed.stdout) - self.assertFalse((self.root / ".cambium").exists()) + self.assert_no_task_runtime() self.assertEqual([], list(self.root.glob(".cambium-init-*"))) def test_missing_or_invalid_task_contract_never_publishes(self): @@ -703,10 +711,11 @@ def test_missing_or_invalid_task_contract_never_publishes(self): stderr=subprocess.STDOUT, check=False, ) self.assertNotEqual(0, completed.returncode, completed.stdout) - self.assertFalse((self.root / ".cambium").exists()) + self.assert_no_task_runtime() self.assertEqual([], list(self.root.glob(".cambium-init-*"))) def test_preexisting_empty_namespace_is_not_replaced(self): + shutil.rmtree(self.root / ".cambium") (self.root / ".cambium").mkdir() completed = subprocess.run( self.command(), text=True, stdout=subprocess.PIPE, @@ -714,9 +723,8 @@ def test_preexisting_empty_namespace_is_not_replaced(self): ) self.assertEqual(1, completed.returncode, completed.stdout) self.assertEqual([], list((self.root / ".cambium").iterdir())) - self.assertIn("existing_runtime_summary=unavailable", completed.stdout) - self.assertIn("Tools/check_queue.py", completed.stdout) - self.assertIn("--resume-status", completed.stdout) + self.assertIn("active Standards state", completed.stdout) + self.assertIn("standards_state.yaml", completed.stdout) class RepositoryTargetSnapshotTests(unittest.TestCase): diff --git a/Tools/tests/test_standards_state.py b/Tools/tests/test_standards_state.py new file mode 100644 index 0000000..24c875a --- /dev/null +++ b/Tools/tests/test_standards_state.py @@ -0,0 +1,67 @@ +import sys +import tempfile +import unittest +from pathlib import Path + +TOOLS = Path(__file__).resolve().parents[1] +sys.path.insert(0, str(TOOLS)) +import standards_state + + +class StandardsStateTests(unittest.TestCase): + def value(self): + return { + "schema_version": 1, + "state_revision": 3, + "standards_version": "3.12.0", + "status": "approved", + "effective_date": "2026-08-21", + "selected_profile_manifest": "profiles/agent-atlas/profile.md", + "latest_adoption_receipt": "audit-adopt_standards-example-0001", + "upstream_source_ref": "https://github.com/KimGLee/Cambium", + "upstream_revision_id": "abc123", + } + + def test_round_trip_and_snapshot(self): + value = self.value() + text = standards_state.canonical_text(value) + parsed, errors = standards_state.parse(text) + self.assertEqual(errors, []) + self.assertEqual(parsed, value) + with tempfile.TemporaryDirectory() as directory: + root = Path(directory) + path = root / standards_state.STATE_PATH + path.parent.mkdir(parents=True) + path.write_text(text, encoding="utf-8") + state, view, errors = standards_state.snapshot(root) + self.assertEqual(errors, []) + self.assertEqual(state, value) + self.assertEqual(view["active_standards_path"], standards_state.STATE_PATH) + self.assertEqual(view["standards_version"], "3.12.0") + + def test_closed_and_no_markdown_fallback(self): + value = self.value() + value["history"] = [] + self.assertIn("unsupported field", "; ".join( + standards_state.state_errors(value))) + with tempfile.TemporaryDirectory() as directory: + state, view, errors = standards_state.snapshot(directory) + self.assertIsNone(state) + self.assertIsNone(view) + self.assertIn("absent", "; ".join(errors)) + + def test_next_state_advances_only_current_identity(self): + before = self.value() + after = standards_state.next_state( + before, standards_version="3.13.0", + effective_date="2026-08-22", + selected_profile_manifest="profiles/agent-atlas/profile.md", + latest_adoption_receipt="audit-next-0001", + upstream_source_ref="upstream", upstream_revision_id="def456") + self.assertEqual(after["state_revision"], 4) + self.assertNotIn("change_summary", after) + self.assertNotIn("history", after) + + +if __name__ == "__main__": + unittest.main() diff --git a/Tools/tests/test_update_queue.py b/Tools/tests/test_update_queue.py index b92cf60..29a3435 100644 --- a/Tools/tests/test_update_queue.py +++ b/Tools/tests/test_update_queue.py @@ -1699,7 +1699,7 @@ def own_and_external_then_fail(path, receipts, **kwargs): self.assertTrue(lock["operation_receipt"]["matching_receipt"]) self.assertEqual( {"coverage": "before", "progress": "planned-after", - "queue": "planned-after"}, + "queue": "planned-after", "standards": "unavailable"}, {name: phase["phase"] for name, phase in lock["state_phases"].items()}, ) diff --git a/Tools/tests/test_vocab_artifact_integrity.py b/Tools/tests/test_vocab_artifact_integrity.py index 26ed0d2..b61d461 100644 --- a/Tools/tests/test_vocab_artifact_integrity.py +++ b/Tools/tests/test_vocab_artifact_integrity.py @@ -32,9 +32,10 @@ sys.path.insert(0, str(TOOLS)) import kblib # noqa: E402 +import standards_state # noqa: E402 from Tools.tests.profile_fixture import install_loadable_profile -ACTIVE_STATE = "kernel/K00 Standards Control/03 Standards Governance.md" +ACTIVE_STATE = standards_state.STATE_PATH VOCABULARY_BASE = "kernel/K08 Metadata and Status/vocabulary-base.yaml" PROFILE_ID = "agent-atlas" @@ -54,7 +55,8 @@ def build_composable_tree(destination): "check_freshness.py", "freshness_engine.py", "maintenance_candidates.py", "profile_admission.py", "check_profile.py", - "profile_contract.py", "metadata_execution_contract.py"): + "profile_contract.py", "metadata_execution_contract.py", + "standards_state.py"): shutil.copy2(TOOLS / name, tools / name) source_profile = install_loadable_profile( @@ -84,16 +86,13 @@ def build_composable_tree(destination): shutil.copy2(REPOSITORY / VOCABULARY_BASE, destination / VOCABULARY_BASE) state = destination / ACTIVE_STATE - state.parent.mkdir(parents=True, exist_ok=True) - text = (REPOSITORY / ACTIVE_STATE).read_text(encoding="utf-8") - for placeholder, value in ( - ("{{ standards_version }}", "1.0.0"), - ("{{ standards_status }}", "approved"), - ("{{ standards_effective_date }}", "2026-01-01"), - ("{{ selected_profile_manifest }}", - "profiles/examples/%s/profile.md" % PROFILE_ID)): - text = text.replace(placeholder, value) - state.write_text(text, encoding="utf-8") + current, _view, errors = standards_state.snapshot(destination) + assert not errors, errors + current = dict(current) + current["selected_profile_manifest"] = ( + "profiles/examples/%s/profile.md" % PROFILE_ID) + state.write_text( + standards_state.canonical_text(current), encoding="utf-8") return destination @@ -372,17 +371,13 @@ def test_a_rejected_document_is_never_published(self): class UnselectedProfileStaysLegal(unittest.TestCase): - """K00/03: a distribution with no selected profile carries no artifact.""" + """A distribution with no adopter state carries no selected artifact.""" def test_compose_refuses_without_selecting_one_and_writes_nothing(self): with tempfile.TemporaryDirectory() as temporary: tree = build_composable_tree(Path(temporary)) state = tree / ACTIVE_STATE - state.write_text( - state.read_text(encoding="utf-8").replace( - "`profiles/examples/%s/profile.md`" % PROFILE_ID, - "`{{ selected_profile_manifest }}`"), - encoding="utf-8") + state.unlink() completed = compose(tree) self.assertEqual(1, completed.returncode, completed.stdout) self.assertFalse( diff --git a/kernel/Cards/Card Index.md b/kernel/Cards/Card Index.md index a8b4d72..6a7390e 100644 --- a/kernel/Cards/Card Index.md +++ b/kernel/Cards/Card Index.md @@ -7,8 +7,8 @@ source_files: - kernel/K00 Standards Control/01 Operating Role and Reading Protocol.md - kernel/K00 Standards Control/02 Task Routing.md - kernel/K00 Standards Control/03 Standards Governance.md -source_hash: '04058244f69a' -compiled_source_hash: '04058244f69a' +source_hash: '9fb29e8300cc' +compiled_source_hash: '9fb29e8300cc' route_registry: - route_id: R01 path: "kernel/Cards/R01 Core Bootstrap Card.md" @@ -100,7 +100,7 @@ the same `route_id`. - A profile extension uses its own namespaced identity and loads alongside a kernel route. It cannot reuse an Rxx identity or weaken the kernel gate. -Record the active `selected_profile_manifest`, selected `route_id` values, +Record the canonical-state `selected_profile_manifest`, selected `route_id` values, Card paths, and the derived Read Set/module loading envelope. Those frozen paths state what must be available; they do not prove delivery. Batch activation carries the exact selected Card bytes in a content-addressed Bundle, diff --git a/kernel/Cards/R01 Core Bootstrap Card.md b/kernel/Cards/R01 Core Bootstrap Card.md index 55b4f9c..e8b9951 100644 --- a/kernel/Cards/R01 Core Bootstrap Card.md +++ b/kernel/Cards/R01 Core Bootstrap Card.md @@ -20,8 +20,8 @@ source_files: - kernel/K13 Task Runtime and Execution Control/11 Completion Policy.md readback_sources: [] readback_policy: none -source_hash: 'edf230597940' -compiled_source_hash: 'edf230597940' +source_hash: '7d03b7f04f48' +compiled_source_hash: '7d03b7f04f48' --- # R01 Core Bootstrap Card @@ -47,11 +47,12 @@ The selected profile's `Priority Rubric` grants P0/P1. Record the tier in the Co R01 plus every selected task Card. Treat an unbound CLI delivery as degraded; it does not prove injection into an Agent execution context. - [ ] State the objective, target scope, exclusions, and latest user instructions. -- [ ] Inspect the repository root for `.cambium/` before any content or state - write. If it exists, run `python3 Tools/check_queue.py . --resume-status`, +- [ ] Inspect the repository root for `.cambium/state/` before any content or + task-state write. If it exists, run `python3 Tools/check_queue.py . --resume-status`, reconcile the recorded task and exact `next_action`, and do not initialize a - replacement. If it is absent, only a selected persistent, resumable, or - multi-batch route may initialize it. + replacement. If task state is absent, only a selected persistent, resumable, + or multi-batch route may initialize it beside any valid governance/history + already under `.cambium/`. - [ ] Confirm the active Standards state is instantiated and its one selected profile manifest has a current passing `profile-load` result. That result must bind the Profile directory snapshot and typed dependency-closure diff --git a/kernel/Cards/R02 Single Note Authoring Card.md b/kernel/Cards/R02 Single Note Authoring Card.md index b4f32ba..d0f392e 100644 --- a/kernel/Cards/R02 Single Note Authoring Card.md +++ b/kernel/Cards/R02 Single Note Authoring Card.md @@ -43,8 +43,8 @@ readback_sources: - kernel/K12 Quality Assurance/11 Content-level Propagation.md - kernel/K12 Quality Assurance/13 Visual Verification Escalation.md readback_policy: declared -source_hash: '4f62184cb331' -compiled_source_hash: '4f62184cb331' +source_hash: '2c50b6abf23c' +compiled_source_hash: '2c50b6abf23c' --- # R02 Single Note Authoring Card diff --git a/kernel/Cards/R03 Module Build Card.md b/kernel/Cards/R03 Module Build Card.md index 911d8ee..d1d5b56 100644 --- a/kernel/Cards/R03 Module Build Card.md +++ b/kernel/Cards/R03 Module Build Card.md @@ -38,8 +38,8 @@ readback_sources: - kernel/K10 Writing and Formatting/01 Naming Language and Prose.md - kernel/K12 Quality Assurance/11 Content-level Propagation.md readback_policy: declared -source_hash: '18b36ade39d3' -compiled_source_hash: '18b36ade39d3' +source_hash: '9d5947b6e0fa' +compiled_source_hash: '9d5947b6e0fa' --- # R03 Module Build Card diff --git a/kernel/Cards/R05 Expression Layer Card.md b/kernel/Cards/R05 Expression Layer Card.md index 81648c0..1736d33 100644 --- a/kernel/Cards/R05 Expression Layer Card.md +++ b/kernel/Cards/R05 Expression Layer Card.md @@ -29,8 +29,8 @@ readback_sources: - kernel/K12 Quality Assurance/02 Rendering Verification.md - kernel/K12 Quality Assurance/13 Visual Verification Escalation.md readback_policy: declared -source_hash: '09aa326d154c' -compiled_source_hash: '09aa326d154c' +source_hash: '40bc9ac959a8' +compiled_source_hash: '40bc9ac959a8' --- # R05 Expression Layer Card diff --git a/kernel/Cards/R06 Migration and Refactor Card.md b/kernel/Cards/R06 Migration and Refactor Card.md index 314e93f..5a02417 100644 --- a/kernel/Cards/R06 Migration and Refactor Card.md +++ b/kernel/Cards/R06 Migration and Refactor Card.md @@ -27,8 +27,8 @@ source_files: readback_sources: - kernel/K03 Note Types and Ownership/02 Ownership and Canonical Notes.md readback_policy: declared -source_hash: '73ce5eb88eaa' -compiled_source_hash: '73ce5eb88eaa' +source_hash: 'c5aa78d90d87' +compiled_source_hash: 'c5aa78d90d87' --- # R06 Migration and Refactor Card diff --git a/kernel/Cards/R07 Long-running Execution Card.md b/kernel/Cards/R07 Long-running Execution Card.md index f2e4e94..9869528 100644 --- a/kernel/Cards/R07 Long-running Execution Card.md +++ b/kernel/Cards/R07 Long-running Execution Card.md @@ -46,8 +46,8 @@ readback_sources: - kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md - kernel/K13 Task Runtime and Execution Control/16 Resume Next Action Vocabulary.md readback_policy: declared -source_hash: '6dcf3f22e9b9' -compiled_source_hash: '6dcf3f22e9b9' +source_hash: 'bd12dc944665' +compiled_source_hash: 'bd12dc944665' --- # R07 Long-running Execution Card @@ -59,8 +59,8 @@ Run a multi-batch task, sustain checkpoints, resume after interruption, maintain ## Before Start -- [ ] If `.cambium/` exists, run `python3 Tools/check_queue.py . --resume-status` before any state write; resume the recorded task instead of initializing a replacement. -- [ ] If persistent runtime state is authorized and `.cambium/` is absent, create the empty namespace with `init_state.py`, commit the exact initial Task Plan with `apply_task_plan.py`, then derive Queue views with `compile_queue.py`. Never materialize Coverage or Queue by hand. +- [ ] If `.cambium/state/` exists, run `python3 Tools/check_queue.py . --resume-status` before any state write; resume the recorded task instead of initializing a replacement. +- [ ] If persistent runtime state is authorized and `.cambium/state/` is absent, create the empty task namespace with `init_state.py` while preserving any adopter governance/history, commit the exact initial Task Plan with `apply_task_plan.py`, then derive Queue views with `compile_queue.py`. Never materialize Coverage or Queue by hand. - [ ] Freeze the long-run Task Contract: Standards/Profile fingerprints, time semantics, route/Card paths, derived source-delivery boundary, completion semantics, and Queue identity. Delivery is evidenced separately; Profile closure members remain derived Gate output. - [ ] Reconcile `.cambium/` Coverage, Queue, and Progress with the file system and user modifications. Ready, open, and merge-ready lists are derived from the Queue, never edited in Progress as a second authority. - [ ] For persistent multi-batch corpus work, require Corpus Planning `applicability.state: configured` and pass `check_corpus_plan.py`; use its on-demand `--json` projection for recovery and R13 for any planning edit. diff --git a/kernel/Cards/R08 Audit and Completion Card.md b/kernel/Cards/R08 Audit and Completion Card.md index 7b1cf70..3959664 100644 --- a/kernel/Cards/R08 Audit and Completion Card.md +++ b/kernel/Cards/R08 Audit and Completion Card.md @@ -22,8 +22,8 @@ source_files: - kernel/K13 Task Runtime and Execution Control/13 Final Handoff.md readback_sources: [] readback_policy: none -source_hash: '8f92a0342036' -compiled_source_hash: '8f92a0342036' +source_hash: '1eca9b5a131e' +compiled_source_hash: '1eca9b5a131e' --- # R08 Audit and Completion Card diff --git a/kernel/Cards/R09 Standards Governance Card.md b/kernel/Cards/R09 Standards Governance Card.md index 71a50b2..ccf6df4 100644 --- a/kernel/Cards/R09 Standards Governance Card.md +++ b/kernel/Cards/R09 Standards Governance Card.md @@ -38,8 +38,8 @@ readback_sources: - kernel/K12 Quality Assurance/02 Rendering Verification.md - kernel/K12 Quality Assurance/05 Automated and Manual Checks.md readback_policy: activation -source_hash: '618c93c9da94' -compiled_source_hash: '618c93c9da94' +source_hash: '30f6ab17a5f6' +compiled_source_hash: '30f6ab17a5f6' --- # R09 Standards Governance Card @@ -55,12 +55,12 @@ Modify kernel rules, Read Sets, Cards, versions, directories, ownership, tooling - [ ] Load [[kernel/Cards/R01 Core Bootstrap Card|Core Bootstrap]], then verify the activation Bundle delivered [[kernel/Read Sets/R09 Standards Governance Read Set|R09 Read Set]] and its Start list in full under `readback_policy: activation`. -- [ ] Choose the branch: for initial adoption, freeze the four K00/03 placeholders and upstream provenance, then admit the candidate through `profile-load`; for a later revision, freeze the active Standards version and selected profile manifest, and separately admit the after Profile through the same Gate. A broken current Profile is impact evidence, not a prerequisite that can deadlock correction. In both branches freeze affected modules, incoming links, changed predicates, active-task impact, and rollback/conservation boundary. +- [ ] Choose the branch: for initial adoption, prove the canonical adopter Standards state is absent, freeze upstream provenance, then admit the candidate through `profile-load`; for a later revision, freeze the current state bytes and separately admit the after Profile through the same Gate. A broken current Profile is impact evidence, not a prerequisite that can deadlock correction. In both branches freeze affected modules, incoming links, changed predicates, active-task impact, and rollback/conservation boundary. - [ ] Identify the single canonical owner for every rule being changed and the existing control that is superseded. ## During -- Record the affected Standards and reason, update version/state, routing, Change Summary, and changed predicates. Initial adoption instantiates K00/03; later changes record old/new manifests. Both recompose vocabulary and stamp Cards. For each affected task, declare the Contract-version edge, ensure Work Specs are compatible, and bind its K12/10 YAML to approved K00/03 bytes plus deterministic Kernel/Profile snapshots and the after Profile's typed-contract fingerprint. Keep that derived closure outside Read Set load lists; never write task Ledgers or create a second revision/prose copy. +- Record the affected Standards and reason, update rules/routing and changed predicates, and let the adoption transaction append history receipts. Initial adoption creates `.cambium/governance/standards_state.yaml`; later changes advance it. Both recompose vocabulary and stamp Cards. For each affected task, declare the Contract-version edge, ensure Work Specs are compatible, and bind its K12/10 YAML to unchanged K00/03 rule bytes, the exact state before-image, deterministic Kernel/Profile snapshots, and the after Profile's typed-contract fingerprint. Keep that derived closure outside Read Set load lists; never write task Ledgers or create a second revision/prose copy. - For a structural migration, map every original H2 block to exactly one new owner. Never use splitting as reduction, summary, or silent deletion. - Keep the Overview, Standard Module MOCs, Read Sets, rule registry, control registry, links, and module paths synchronized. - For a new or re-scoped check, register its receipt dimension, audit layer, object, evidence role, and acceptance owner before closure. diff --git a/kernel/Cards/R10 Maintenance Run Card.md b/kernel/Cards/R10 Maintenance Run Card.md index 5616898..2ee23e1 100644 --- a/kernel/Cards/R10 Maintenance Run Card.md +++ b/kernel/Cards/R10 Maintenance Run Card.md @@ -26,8 +26,8 @@ readback_sources: - kernel/K12 Quality Assurance/11 Content-level Propagation.md - kernel/K12 Quality Assurance/12 Substantive Correctness Review.md readback_policy: declared -source_hash: '37481f0b4cc3' -compiled_source_hash: '37481f0b4cc3' +source_hash: 'ef73059497be' +compiled_source_hash: 'ef73059497be' --- # R10 Maintenance Run Card @@ -41,11 +41,12 @@ Perform periodic freshness, re-verification, watermark, `needs_rereview`, or can - [ ] Confirm the activation Bundle contains R01, R10, and the exact frozen maintenance reading plan before selecting candidates. -- [ ] Inspect the repository root for `.cambium/` before any write. If it +- [ ] Inspect the repository root for `.cambium/state/` before any write. If it exists, run `python3 Tools/check_queue.py . --resume-status` and follow its exact `next_action`; never initialize a replacement or restart candidate age. -- [ ] If `.cambium/` is absent, initialize it only for a persistent, resumable, - or multi-batch run, with `completion_semantics: maintenance`. A bounded +- [ ] If task state is absent, initialize it only for a persistent, resumable, + or multi-batch run, preserving governance/history under `.cambium/`, with + `completion_semantics: maintenance`. A bounded single-note run does not create an empty runtime namespace. - [ ] Choose exactly one budget envelope: N pages, N batches, or N hours. - [ ] Build the candidate manifest from the complete freshness candidate set diff --git a/kernel/Cards/R11 Large-scale Work Admission Card.md b/kernel/Cards/R11 Large-scale Work Admission Card.md index 5bc61bb..9ed911c 100644 --- a/kernel/Cards/R11 Large-scale Work Admission Card.md +++ b/kernel/Cards/R11 Large-scale Work Admission Card.md @@ -21,8 +21,8 @@ source_files: readback_sources: - kernel/K12 Quality Assurance/19 Incremental Audit Planning.md readback_policy: declared -source_hash: '097458e2711b' -compiled_source_hash: '097458e2711b' +source_hash: 'e3e0aed9df30' +compiled_source_hash: 'e3e0aed9df30' --- # R11 Large-scale Work Admission Card @@ -38,7 +38,7 @@ Load before large-scale creation, moves, or deletion, together with [[kernel/Car Bundle before the admission checklist is used to authorize work. - [ ] Record contract, scope, initial batch, Standards version, exact `selected_profile_manifest`, selected routes and Cards, the derived loading envelope, target scope, exclusions, and latest user requirements; delivery receipts, not the frozen envelope, record actual context delivery. - [ ] Make `minimum_run_until`, `checkpoint_at`, `hard_stop_at`, and the Completion Gate explicit; leave unspecified fields explicitly empty. -- [ ] Initialize `.cambium/` only when absent. If it exists, first run `check_queue.py --resume-status` and reconcile the recorded task; bind Coverage, Required Queue, and Progress to the same task, scope, Standards version, and selected profile. +- [ ] Initialize task state only when `.cambium/state/` is absent. If it exists, first run `check_queue.py --resume-status` and reconcile the recorded task; preserve a governance-only `.cambium/` parent, and bind Coverage, Required Queue, and Progress to the same task, scope, Standards version, and selected Profile. - [ ] Reconcile Coverage with the file system and exclusions; inventory ownership, incoming links, user modifications, explicit batch manifests, and dependencies. - [ ] Require Corpus Planning `applicability.state: configured`; reconcile the bound Global Map, Capability Matrix, and Gap Register and pass `Tools/check_corpus_plan.py`. Use R13 to create or repair them; R11 only consumes this admission condition. - [ ] Compile the Queue from explicit Coverage inputs, record its path/revisions/fingerprint, and require `python3 Tools/check_queue.py .` plus `--require-ready ` to pass. diff --git a/kernel/Cards/R12 Targeted and Specialized Audit Card.md b/kernel/Cards/R12 Targeted and Specialized Audit Card.md index a9dfeb7..a4dc7d9 100644 --- a/kernel/Cards/R12 Targeted and Specialized Audit Card.md +++ b/kernel/Cards/R12 Targeted and Specialized Audit Card.md @@ -18,8 +18,8 @@ source_files: - kernel/K02 Knowledge Work Construction/07 Gap Register Contract.md readback_sources: [] readback_policy: none -source_hash: '01046cfca948' -compiled_source_hash: '01046cfca948' +source_hash: 'ec85207eaa7d' +compiled_source_hash: 'ec85207eaa7d' --- # R12 Targeted and Specialized Audit Card diff --git a/kernel/K00 Standards Control/03 Standards Governance.md b/kernel/K00 Standards Control/03 Standards Governance.md index 6567090..9d90fa0 100644 --- a/kernel/K00 Standards Control/03 Standards Governance.md +++ b/kernel/K00 Standards Control/03 Standards Governance.md @@ -4,18 +4,25 @@ - Previous: [[kernel/K00 Standards Control/02 Task Routing|Task Routing]]. - Next: [[kernel/K00 Standards Control/04 Control State and Scope|Control State and Scope]]. -## Standards Control - -| Field | Value | -|---|---| -| Standards version | `{{ standards_version }}` | -| Status | `{{ standards_status }}` | -| Effective date | `{{ standards_effective_date }}` | -| Selected profile manifest | `{{ selected_profile_manifest }}` | -| Change authority | User's explicit governance instruction | -| Content-task behavior | Frozen; read-only control plane | - -The four `{{ ... }}` entries are placeholders. Initial adoption is the first governance release: fill a copy of `profiles/_template/`; pass the `profile-load` Gate against that candidate; record exactly one `profiles//profile.md`, a version, `approved` status, and date here; record upstream tag, commit, or archive checksum in the Change Summary; compose vocabulary; stamp Cards; pass governance checks. This is adopter state, not Cambium release metadata. Until all four values are instantiated, the standard is pre-release and content tasks cannot freeze a Task Contract. +## Standards State And Adoption History + +This page owns governance rules only. It MUST NOT carry an adopter's current +version/Profile values or a chronological adoption register. + +The canonical current adopter identity is the closed restricted-YAML document +`.cambium/governance/standards_state.yaml`, whose schema is shipped at +`Tools/schemas/standards_state.template.yaml`. It records exactly one current +version, approval status, effective date, selected Profile manifest, upstream +identity, state revision, and latest adoption receipt. Its absence means the +public distribution or an uninstantiated adopter; content tasks cannot freeze +a Task Contract until the initial R09 transaction creates it. + +The canonical history is the append-only Standards-adoption receipt stream. +Each adoption receipt binds its plan, before/after identity, upstream +provenance, deterministic Kernel/Profile snapshots, and transaction outcome. +No Kernel page, Card, Profile slot, or second Markdown table may reproduce +that chronology as authority. A human history view, if rendered, is a +disposable projection from receipts. The Standards lifecycle is: @@ -30,20 +37,19 @@ When modifying rules, you MUST: 1. Make explicit that this is a governance change, not ordinary content editing. 2. Record the affected Standards and the reason. 3. Bump `standards_version`; changing the selected profile manifest always requires a bump. -4. Update the routing and change summary in `K00`. +4. Update affected routing and normative owners; never append history to a + Kernel page or Card. 5. For every existing affected runtime task, publish the changed-predicate input required by [[kernel/K12 Quality Assurance/10 Standards Version Adoption|K12/10]]. R09 owns the governance revision; R07 later executes or resumes the active-task adoption through the sole K13/15 writer. An empty changed-predicate list takes K12/10's no-predicate-change branch rather than bypassing state synchronization. For an active-task adoption, the restricted-YAML adoption plan is the canonical -machine revision record. Its `governance_revision_ref` must point back to this -file and its SHA-256 must bind these complete approved governance bytes. The -plan additionally binds deterministic after snapshots of the whole `kernel/` -tree and selected Profile directory. The after Profile MUST pass -`profile-load`; because that Gate closes every Profile-owned dependency inside -the directory, the directory snapshot binds the resolved dependency bytes and -the Gate's contract fingerprint binds their typed ownership edges. Its changed-predicate rows are the -machine-consumed list; the Change Summary remains the governance register and -must agree in meaning, but no second Markdown adoption checklist or copied -revision record is created. +machine revision record. It binds deterministic after snapshots of the whole +`kernel/` tree and selected Profile directory and the exact current Standards +state before-image. The after Profile MUST pass `profile-load`; because that +Gate closes every Profile-owned dependency inside the directory, the directory +snapshot binds the resolved dependency bytes and the Gate's contract +fingerprint binds their typed ownership edges. Its changed-predicate rows are +the machine-consumed list. The single-writer transaction advances the adopter +state, task Ledgers, and append-only adoption receipts as one state change. User approval of the Standards does not equal approval of an immediate bulk Frontmatter migration of all legacy pages. The migration scope still needs to enter a specific task contract. @@ -105,10 +111,3 @@ For any structural migration of the standards corpus (splits, moves, renames, or - The `K02 Knowledge Work Construction` standard module holds knowledge-work principles and trigger points; `K13 Task Runtime and Execution Control` holds persistent state and transitions; the `K12 Quality Assurance` standard module holds acceptance checklists. - The same item MUST NOT be held in full text on both sides; the execution side references the acceptance side's detail items via Wiki Link and does not copy checklist content. - -## Change Summary - -The upstream register is empty; initial adoption creates its first entry. Each entry MUST record version, date, change (including profile selection and upstream provenance when applicable), changed predicates, and the IDs of any active-task adoption plans it requires. An empty predicate list selects K12/10's no-predicate-change branch; it does not authorize direct runtime-state edits. - -| Version | Date | Change | Changed predicates | Adoption requirement | -|---|---|---|---|---| diff --git a/kernel/K00 Standards Control/10 Batch Execution Checklist.md b/kernel/K00 Standards Control/10 Batch Execution Checklist.md index 8e2a915..274ff86 100644 --- a/kernel/K00 Standards Control/10 Batch Execution Checklist.md +++ b/kernel/K00 Standards Control/10 Batch Execution Checklist.md @@ -10,7 +10,7 @@ This module owns the ordered sequence one batch runs, from the version self-chec ## Batch Execution Checklist -1. Version self-check: compare the current identity in [[kernel/K00 Standards Control/03 Standards Governance|K00/03]] with the contract-frozen Standards/Profile identity. On mismatch, do not activate: enter R07 for the [[kernel/K12 Quality Assurance/10 Standards Version Adoption|K12/10]] plan and sole [[kernel/K13 Task Runtime and Execution Control/15 Standards Adoption State Transaction|K13/15]] writer. Resume after commit's immediate consistency pass and any gate assigned specifically to this activation boundary; later batch-close/Terminal reruns remain deferred to those boundaries. User notification is only a reminder. +1. Version self-check: compare the current identity in `.cambium/governance/standards_state.yaml` with the contract-frozen Standards/Profile identity. On mismatch, do not activate: enter R07 for the [[kernel/K12 Quality Assurance/10 Standards Version Adoption|K12/10]] plan and sole [[kernel/K13 Task Runtime and Execution Control/15 Standards Adoption State Transaction|K13/15]] writer. Resume after commit's immediate consistency pass and any gate assigned specifically to this activation boundary; later batch-close/Terminal reruns remain deferred to those boundaries. User notification is only a reminder. 2. Reconcile incremental guidance: reconcile only the Guidance Events after `last_reconciled_guidance_id` against the Amendment Log. 3. Select the next `queued` batch from the canonical Required Queue only after `python3 Tools/check_queue.py . --require-ready ` passes; the integrator then records `queued -> open` through `Tools/update_queue.py` with the expected state revision and fingerprint. If its Work Spec pair is non-null, load that exact fingerprinted file after activation; null/null is the complete instruction that this batch is simple. 4. Resolve note type, canonical owner, and target status. diff --git a/kernel/K00 Standards Control/12 Control Registry.md b/kernel/K00 Standards Control/12 Control Registry.md index fb8e650..70d68ab 100644 --- a/kernel/K00 Standards Control/12 Control Registry.md +++ b/kernel/K00 Standards Control/12 Control Registry.md @@ -145,7 +145,7 @@ moves its own cell. | `source-promotion` | `manual-attestation` | `1.0.0` | `source-promotion` | `*` | `coverage_and_integration`, `source_and_currentness` | `not-batch-scoped` | | `expression-layer-acceptance` | `manual-attestation` | `1.0.0` | `expression-layer-acceptance` | `*` | `content_and_depth`, `coverage_and_integration`, `guidance_and_contract`, `source_and_currentness`, `structure_and_links` | `not-batch-scoped` | | `coverage-reconciliation` | `manual-attestation` | `1.0.0` | `coverage-reconciliation` | `*` | `coverage_and_integration` | `not-batch-scoped` | -| `standards-adoption` | `adopt_standards` | `1.6.0` | `standards_adoption` | `*` | `*` | `not-batch-scoped` | +| `standards-adoption` | `adopt_standards` | `1.7.0` | `standards_adoption` | `*` | `*` | `not-batch-scoped` | | `standards-revalidation` | `check_queue` | `1.23.0` | `required_queue` | `require-revalidation:*` | `*` | `queued`, `open` | | `guidance-disposition` | `manual-attestation` | `1.0.0` | `guidance-disposition` | `*` | `guidance_and_contract` | `not-batch-scoped` | | `receipt-validity` | `manual-attestation` | `1.0.0` | `receipt-validity` | `*` | `guidance_and_contract` | `not-batch-scoped` | diff --git a/kernel/K00 Standards Control/13 Runtime Admission and Recovery.md b/kernel/K00 Standards Control/13 Runtime Admission and Recovery.md index 948b39c..162c888 100644 --- a/kernel/K00 Standards Control/13 Runtime Admission and Recovery.md +++ b/kernel/K00 Standards Control/13 Runtime Admission and Recovery.md @@ -13,23 +13,27 @@ applicable Rxx route; K00/13 is a control leaf, not an R13 route. ## Runtime Startup Gate -Before any task writes content or control state, inspect the repository root -for an existing `.cambium/` namespace. This discovery step is universal even +Before any task writes content or task-control state, inspect the repository +root for an existing `.cambium/state/` task runtime. The parent `.cambium/` +may already contain canonical adopter governance and adoption history without +representing a task. This discovery step is universal even when the new request initially appears bounded; an earlier persistent task may still be paused, interrupted, or awaiting integration: -- If `.cambium/` is absent, continue normal routing. Only an authorized - persistent, resumable, or multi-batch task MAY initialize it once with - `Tools/init_state.py` after its task, Standards, scope, profile identity, and - explicit `completion_semantics: build|maintenance` are known; a bounded task - does not create empty runtime state. -- If `.cambium/` exists, the first state action MUST be +- If `.cambium/state/` is absent, there is no task runtime to resume. Continue + normal routing. Only an authorized persistent, resumable, or multi-batch + task MAY initialize it once with `Tools/init_state.py` after its task, + Standards, scope, Profile identity, and explicit + `completion_semantics: build|maintenance` are known. The writer preserves + any governance state and adoption receipts already under `.cambium/`; a + bounded task does not create empty task state. +- If `.cambium/state/` exists, the first state action MUST be `python3 Tools/check_queue.py . --resume-status`. The operator reads the recorded task state, completion semantics and block, checkpoint, Queue revisions/fingerprint, `open`/`merge-ready` items, pending deltas, holds, and writer-lock evidence before deciding whether the existing task can resume. - A new task MUST NOT initialize over, repurpose, or silently reset an existing - namespace. Even a completed or cancelled task remains durable history until + task runtime. Even a completed or cancelled task remains durable history until an explicit archive or rollover procedure handles it; this Standard does not claim that current tools perform that procedure automatically. - A writer lock may identify an active writer or an interrupted write. It MUST @@ -38,8 +42,9 @@ still be paused, interrupted, or awaiting integration: receipts, and pending deltas. Unreliable or inconsistent state fails closed. The startup gate discovers control state; it does not authorize the content -work itself. A bounded task may proceed without creating runtime state only -when the namespace is absent. When it is present, the recorded task is +work itself. A bounded task may proceed without creating task runtime state +when `.cambium/state/` is absent, whether or not governance state exists. When +task state is present, the recorded task is reconciled before any route writes, regardless of the apparent size of the new request. @@ -52,7 +57,7 @@ and MAY begin only after the following conditions are met: 2. Task-specific Read Sets, triggered modules, and gate modules have been resolved per the [[kernel/K00 Standards Control/02 Task Routing#Task Routing Table|Task Routing Table]]. 3. Contract / scope / Standards version / selected profile manifest, the loaded set (selected Rxx route IDs and Runtime Card paths, any combined namespaced profile route, and every Read Set or leaf path actually read back), the target scope, the excluded scope, and the latest user requirements have been recorded. 4. `minimum_run_until`, `checkpoint_at`, `hard_stop_at`, and the Completion Gate have been made explicit; fields not provided are explicitly left empty. -5. The Runtime Startup Gate has passed. The `.cambium/` namespace was initialized only if absent; otherwise the existing task was inspected and legitimately resumed. Coverage, Queue, and Progress agree on task, scope, Standards version, and selected profile manifest. +5. The Runtime Startup Gate has passed. `.cambium/state/` was initialized only if absent; otherwise the existing task was inspected and legitimately resumed. Any pre-existing adopter governance/history was preserved. Coverage, Queue, and Progress agree on task, scope, Standards version, and selected Profile manifest. 6. The Coverage Ledger has been created or refreshed and reconciled against the file system and exclusions; ownership, incoming links, and user modifications have been inventoried. 7. The selected profile's `Corpus Planning` slot uses `applicability.state: configured`; its Global Map, Capability Matrix, and Gap Register bindings exist, reflect the admitted scope, and `python3 Tools/check_corpus_plan.py .` passes. R11 consumes this condition; R13 owns creating or reconciling the artifacts. 8. The Required Queue has been compiled from explicit Coverage assignments and dependencies, and `python3 Tools/check_queue.py .` passes against the current revisions and fingerprint. A missing or empty Queue caused by a wrong path is not a pass. diff --git a/kernel/K00 Standards Control/16 Leaf Module Size Register.md b/kernel/K00 Standards Control/16 Leaf Module Size Register.md index 3afaa46..6cce48b 100644 --- a/kernel/K00 Standards Control/16 Leaf Module Size Register.md +++ b/kernel/K00 Standards Control/16 Leaf Module Size Register.md @@ -18,22 +18,22 @@ This page carries the exception register that [[kernel/K00 Standards Control/03 | Leaf module exception | Measured | Necessity | Growth cap | Follow-up | |---|---|---|---|---| | [[kernel/K08 Metadata and Status/05 Review Source and Migration Metadata\|Review Source and Migration Metadata]] | 6962 bytes | Freshness, review, verification, and semantic-content modification form one causal timeline. The maintenance classifier and Integrator writers need the same definitions to decide whether a review still binds the current content; splitting the modification event from the review baseline would make both halves defer to the other before accepting evidence | 7KB | Registered when `last_content_modified` became an evidence-backed intermediate state and semantic content changes began invalidating prior review authority. Re-measure whenever an event type or freshness baseline is added; split only when a routed consumer can evaluate modification invalidation without resolving the review/freshness timeline | -| [[kernel/K00 Standards Control/03 Standards Governance\|Standards Governance]] | 11815 bytes | R09 reads the whole page for a governance change; R01 reads only Standards Control to resolve the active version and profile. Keeping state with its change process prevents a governance revision from updating one without the other | 12KB | Re-measure at each governance change; raised from 11.5KB to 12KB when the Revision Write-back Checklist separated observed source stamping from explicit semantic compilation acknowledgement and required every Read Set leaf to have a compiled/read-back disposition. That obligation owns governance closure and cannot be moved into the checker that merely enforces it. The earlier raises covered the Distribution Boundary, registered-producer version location, and `profile-load` after-image binding. Split when a routed consumer needs active state without R01 or the governance process | +| [[kernel/K00 Standards Control/03 Standards Governance\|Standards Governance]] | 11374 bytes | R09 reads the whole page because its governance lifecycle, write-back checklist, accretion rule, migration conservation, and size budget jointly define one revision boundary. Instance state and chronological adoption history are deliberately external and therefore no longer contribute to this page's size | 12KB | Re-measure at each governance-rule change. The state/history split has occurred: current identity is `.cambium/governance/standards_state.yaml`, history is the append-only Standards-adoption receipt stream, and neither may grow this Kernel owner. Split again only when a routed governance consumer can decide one remaining rule family without the shared revision boundary | | [[kernel/K00 Standards Control/06 Completion Precedence and Task Contract\|Completion Precedence and Task Contract]] | 7582 bytes | Splitting saves no reader. All four anchored readers of its sections sit inside tasks that already hold the whole page, because [[kernel/Read Sets/R01 Core Bootstrap Read Set\|Core Bootstrap]] reads it at Start for every task. `Maintenance Completion` further MUST stay with `Definition Of Complete`: the page requires one of the two to be declared when the task contract is frozen and forbids mixing their semantics, so a task holding one half could not make that declaration | 8KB | The growth cap on this row was raised from 7KB to 8KB while the page itself stayed unmodified: a re-measure put it at 7582 bytes, over the 7168-byte cap then registered, and the necessity beside it resolves the split test against splitting, so the disposition stays a registered exception and the cap moves instead. The move is declared here as a governance change under [[kernel/K00 Standards Control/03 Standards Governance#Leaf Module Size Budget\|Leaf Module Size Budget]], not left to be read out of a diff. Re-measure whenever a contract decision or a completion semantic is added; the split condition is a routed consumer that resolves standard precedence without holding a task contract | | [[kernel/K00 Standards Control/15 Read Set Loading Boundaries\|Read Set Loading Boundaries]] | 7643 bytes | Its routed consumers load the page to derive and record one Read Set/module load contract. The two sections are one obligation read from both ends: `Default Read Sets` registers the boundaries that name every leaf, and `Derived Load Set` states what a declaration resolved from those boundaries MUST contain, so a split would make every containment question return to the boundary registry it was split from | 7.5KB | Raised from 7KB to 7.5KB when the page made each paired Runtime Card account for every boundary leaf as either compiled guidance or intentional read-back. That rule belongs beside the boundary it closes and prevents structural reachability from being mistaken for semantic coverage. The distinct Profile closure remains split to [[kernel/K00 Standards Control/17 Profile Dependency Closure\|K00/17]]. Re-measure whenever a Read Set or load-set rule is added; split when a routed consumer resolves the declared load set without needing the boundary registry it derives from | | [[kernel/K03 Note Types and Ownership/01 Note Type Catalog\|Note Type Catalog]] | 6668 bytes | One catalog whose function is choosing among its sixteen types. Both routed consumers, the Single Note Authoring and Module Build Read Sets, load it for that same choice, and no page links an individual type, so a split by type group would make every choice read both groups | 7KB | Re-measure whenever a note type is added. Its seven `Examples:` lines (561 bytes) were tested against the cut-examples remedy and held: they are what a reader compares against to decide which of the sixteen types a page is, so cutting them would remove the judgment the catalog exists to support. The split condition is a routed consumer that already knows its type group before opening the catalog | | [[kernel/K06 Knowledge Intake and Evolution/03 Source-to-Knowledge Pipeline\|Source-to-Knowledge Pipeline]] | 7443 bytes | Its two externally entered gates are already extracted to [[kernel/K06 Knowledge Intake and Evolution/07 Environmental Scanning and Watermark\|K06/07]] and [[kernel/K06 Knowledge Intake and Evolution/08 Canonical Promotion Gate\|K06/08]], which are the only stages a consumer enters on its own. What remains is one traversal: Stages 2-8 and 10 have no meaning without the stages before them, and both routed consumers, the Source-driven Expansion Read Set at Start and the Source-driven Expansion Batch of [[kernel/K02 Knowledge Work Construction/09 Knowledge Batch Production\|K02/09]] which requires Stage 1-10 in full, run them in order in a single pass | 7.5KB | Re-measure whenever a stage is added; the next split MUST be a stage a consumer can enter on its own, as K06/07 and K06/08 were, never a range of the traversal | -| [[kernel/K12 Quality Assurance/05 Automated and Manual Checks\|Automated and Manual Checks]] | 10209 bytes | Its sections are one classification of the same finding: what a script decides, what a domain rule decides, and what still needs a person — and now the admission criterion that decides which side a rule falls on. All five routed consumers load it at their Gate to place a finding among the three, no page links a section of it, and separating them would leave each part deferring to the others for the findings it does not cover | 10KB | Re-measure whenever a check is added; raised from 8KB to 10KB when the page gained the Codification Admission section — the four-question test, judge-not-adjudicate, the closed list of judgments that must never be disguised as deterministic checks, and the registration duty. The criterion for the automated/manual boundary belongs on the page that owns that boundary and nowhere else; before this raise it lived in an unowned working document that only its original executor remembered to apply. The earlier 7.5KB-to-8KB raise applies when Profile registry checks were bound to their `profile-load` producer instead of being left as an unowned path check. The split condition is a routed consumer that classifies a finding as automated without needing to know whether the manual path applies | +| [[kernel/K12 Quality Assurance/05 Automated and Manual Checks\|Automated and Manual Checks]] | 10223 bytes | Its sections are one classification of the same finding: what a script decides, what a domain rule decides, and what still needs a person — and now the admission criterion that decides which side a rule falls on. All five routed consumers load it at their Gate to place a finding among the three, no page links a section of it, and separating them would leave each part deferring to the others for the findings it does not cover | 10KB | Re-measure whenever a check is added; raised from 8KB to 10KB when the page gained the Codification Admission section — the four-question test, judge-not-adjudicate, the closed list of judgments that must never be disguised as deterministic checks, and the registration duty. The criterion for the automated/manual boundary belongs on the page that owns that boundary and nowhere else; before this raise it lived in an unowned working document that only its original executor remembered to apply. The earlier 7.5KB-to-8KB raise applies when Profile registry checks were bound to their `profile-load` producer instead of being left as an unowned path check. The split condition is a routed consumer that classifies a finding as automated without needing to know whether the manual path applies | | [[kernel/K12 Quality Assurance/07 Audit Evidence Reuse and Invalidation\|Audit Evidence Reuse and Invalidation]] | 26048 bytes | Its four separable tenants are already extracted to [[kernel/K12 Quality Assurance/09 Batch-close Closed List\|K12/09]], [[kernel/K12 Quality Assurance/10 Standards Version Adoption\|K12/10]], [[kernel/K12 Quality Assurance/11 Content-level Propagation\|K12/11]], and [[kernel/K12 Quality Assurance/19 Incremental Audit Planning\|K12/19]]. What remains answers one question — may this run reuse the receipt it holds, or must it recompute — and no routed consumer reaches a part of it alone: the receipt schema is unreadable without the audit layers it is keyed by, and the Reuse Gate and Invalidation are the two halves of that one answer, so separating them would leave each half deferring to the other | 25.5KB | Re-measure whenever an audit layer or a receipt dimension is added; raised from 24.5KB to 25.5KB when silent non-resolution was closed: a reference that resolves in neither the hot register nor the cold chain MUST fail the run closed rather than be read as the absence of what it asserts, an explicit sealed branch MAY resolve a sealed body provided it re-proves that record's own hash at the read, and the aggregate a recorded Queue transition consumed joins the rows sealing never moves. An adopter had already sealed those aggregates, reopening obligations its own transitions had discharged while every run still reported zero errors -- a standard whose consumers can lose evidence silently is the defect this raise pays to remove. The earlier raise from 23.5KB to 24.5KB when the sealing section's operating boundary was made normative: sealing is a maintenance-window operation with a single writer, the append marker is a guard against the accident rather than a proof of mutual exclusion, automatic recovery covers the publication paths the writer implements while every other interruption owes only fail-closed plus preserved evidence plus a runbook, and the containment checks are detection rather than prevention. A standard that overstates what its implementation guarantees is the defect this raise pays to remove. The earlier raise from 21.5KB to 23.5KB followed review finding the corrected sealing section still described only half a protocol: it now states the shared append mutex that makes a rewrite safe, the recovery rules that make an interrupted seal finishable without an operator, the supported-producer requirement, and the containment rule that keeps sealed bytes inside the repository they are evidence for. Those are the conditions under which this page's reuse answer may be given at all, not a new tenant. The earlier raise from 19KB to 21.5KB corrected the section's original claim that full byte-hash verification is deliberately not a per-run cost. The first version of that section stated that full byte-hash verification is deliberately not a per-run cost; measurement showed the avoided work was 0.42s against the 1.33s sealing actually retires, so the page now states the integrity obligation, the seal-receipt binding that roots the two cold registers, and the compare-and-swap and journal rules that make sealing survive a concurrent writer and its own interruption. Those are the conditions under which this page's reuse answer may be given at all, not a new tenant. Earlier raise: from 16KB to 19KB when the page gained Receipt Sealing and the Cold Chain -- the rule that verified frozen history moves out of the hot parse path while staying resolvable is the reuse/invalidation question applied to whole registers, and its fail-closed consumer contract belongs beside the Invalidation rules it extends. Earlier raise: from 15KB to 16KB when `profile-load` gained its exact snapshot/contract reuse rule and downstream edge-specific invalidation. Those rules answer this page's existing reuse question and do not create a new audit tenant. The next split MUST be a whole tenant with its own routed consumer, never a section of the reuse decision | | [[kernel/K00 Standards Control/09 Default Constraints Snapshot\|Default Constraints Snapshot]] | 6634 bytes | It is the standing constraint list a long-running task holds from Start without being told again. Both routed consumers, the Long-running Execution and Standards Governance Read Sets, load it whole and no page links a section of it, so a split by domain would make every task load both halves to know what is in force | 7KB | Re-measure whenever a default is added; the split condition is a routed consumer that needs one domain's defaults without holding the standing list | -| [[kernel/K00 Standards Control/13 Runtime Admission and Recovery\|Runtime Admission and Recovery]] | 6182 bytes | Its two gates already have distinct routed consumers, but [[kernel/Read Sets/R01 Core Bootstrap Read Set\|Core Bootstrap]] names the page itself at Start for every task, so splitting them would add a second page to the startup path without removing one from it. It stands 38 bytes over the soft cap | 6.5KB | Re-measure whenever an admission or recovery step is added. The next split is `Runtime Startup Gate` from `Large-scale Pre-execution Gate`, whose consumers are already separate (R01/R07 and R11), once R01 no longer needs the page whole at Start | +| [[kernel/K00 Standards Control/13 Runtime Admission and Recovery\|Runtime Admission and Recovery]] | 6564 bytes | Its two gates already have distinct routed consumers, but [[kernel/Read Sets/R01 Core Bootstrap Read Set\|Core Bootstrap]] names the page itself at Start for every task, so splitting them would add a second page to the startup path without removing one from it. It stands 420 bytes over the soft cap | 6.5KB | Re-measure whenever an admission or recovery step is added. The next split is `Runtime Startup Gate` from `Large-scale Pre-execution Gate`, whose consumers are already separate (R01/R07 and R11), once R01 no longer needs the page whole at Start | | [[kernel/K02 Knowledge Work Construction/04 Corpus Planning Runtime Audit and Gate Boundaries\|Corpus Planning Runtime Audit and Gate Boundaries]] | 6330 bytes | Six routed consumers load it, each to place one boundary between corpus-planning runtime state and the audit that gates it. No page links a section of it, and the agent query is defined as what the machine gates do not settle, so separating them would leave each half deferring to the other | 6.5KB | Re-measure whenever a gate boundary or a projection rule is added; the split condition is a routed consumer that reads the runtime boundary without needing the gate that admits it | | [[kernel/K12 Quality Assurance/01 Quality Dimensions and Single Note Review\|Quality Dimensions and Single Note Review]] | 6663 bytes | The `M-tier Gate Checklist` is what both routed consumers open the page for, and three of the four anchors used elsewhere name it. The dimensions above it are the vocabulary its items are written in, so a split would make every checklist read return to the dimension list it was split from | 7KB | Re-measure whenever a quality dimension or a checklist item is added; the split condition is a routed consumer that applies the checklist without resolving a dimension name | | [[kernel/K12 Quality Assurance/09 Batch-close Closed List\|Batch-close Closed List]] | 16798 bytes | One closed list in one section. All anchor references corpus-wide name that single section, and routed consumers load it for the same membership question; the list is closed, so a split would create a second place where membership is decided | 16.5KB | Re-measure whenever a closed-list member or member protocol changes; raised from 14.5KB to 16.5KB when the same closed-list protocol gained routed-gap settlement before any expensive member and exact-carry partitioning for byte-identical durable candidate decisions. These are invocation and acceptance rules of existing members, not new members. Earlier: raised from 13KB to 14.5KB when the attestation's candidate evidence went compact -- the externalized born-cold evidence file, its binding fields, and the inline-policy-exception rule are the acceptance protocol of the existing candidate member, not a ninth member. Earlier re-measure at 13091 bytes when priority-quota candidates gained their bounded-contract-exception acceptance carve-out — an acceptance rule of the existing candidate member, not a ninth member. Raised from 12KB to 13KB when one admitted immutable Profile view was required to bind item 6's verifier/config execution and current Corpus/Vocabulary children across the whole close transaction. This is still the invocation protocol of the same closed-list members, not a new member. The earlier 11KB-to-12KB raise applies when item 6 was required to consume the canonical Profile contract before verifier launch and the separate `profile-load`/residual risk objects were fixed. These are invocation conditions of the existing member, not a ninth member. Earlier raises carry item 8 and item 6's positive-control protocol. The split condition is a routed consumer that needs part of the closed list without the rest, which a closed list does not admit | -| [[kernel/K12 Quality Assurance/10 Standards Version Adoption\|Standards Version Adoption]] | 15721 bytes | One transaction. Trigger, adoption plan, branches, and acceptance are the ordered steps of a single adoption; both routed consumers run them in order in a single pass | 16KB | Re-measure whenever an adoption branch or an invariant is added; raised from 13.5KB to 16KB when current plans gained the closed semantic-leaf-to-owner projection, claim-edge enforcement, native-transition deferral, and producer-era replay boundary. These are authorization rules of the same adoption transaction, not a new routed tenant; raised from 13KB to 13.5KB when the 1.5 producer's upstream identity pair joined the same producer-era paragraph -- a recorded input of the existing transaction, not a new branch. Raised from 12.5KB to 13KB when the same transaction gained the root-owned profile-load-input fingerprint, approved K00/03 identity binding, and producer-era-compatible compare-and-swap at every publication edge. These are atomicity inputs of the existing adoption, not a separable branch. The earlier 10KB-to-12.5KB raise applies when the existing adoption transaction was required to persist the typed Profile contract fingerprint, preserve its pre-1.3 replay boundary, and re-CAS the admitted Profile before/after state and final receipt publication, including the different recovery rule once commit evidence may be durable. Those rules determine whether this same transaction may publish or must roll back; splitting them would make the transaction defer its own atomicity contract elsewhere. The earlier raise carries the after-image boundary, deferred-rerun exclusion, corrective-adoption asymmetry, lifecycle-position claims, and producer-era identity. The split condition is a routed consumer that enters one branch without holding the plan that selected it | +| [[kernel/K12 Quality Assurance/10 Standards Version Adoption\|Standards Version Adoption]] | 16065 bytes | One transaction. Trigger, adoption plan, branches, and acceptance are the ordered steps of a single adoption; both routed consumers run them in order in a single pass | 16KB | Re-measure whenever an adoption branch or an invariant is added; raised from 13.5KB to 16KB when current plans gained the closed semantic-leaf-to-owner projection, claim-edge enforcement, native-transition deferral, and producer-era replay boundary. These are authorization rules of the same adoption transaction, not a new routed tenant; raised from 13KB to 13.5KB when the 1.5 producer's upstream identity pair joined the same producer-era paragraph -- a recorded input of the existing transaction, not a new branch. Raised from 12.5KB to 13KB when the same transaction gained the root-owned profile-load-input fingerprint, approved K00/03 identity binding, and producer-era-compatible compare-and-swap at every publication edge. These are atomicity inputs of the existing adoption, not a separable branch. The earlier 10KB-to-12.5KB raise applies when the existing adoption transaction was required to persist the typed Profile contract fingerprint, preserve its pre-1.3 replay boundary, and re-CAS the admitted Profile before/after state and final receipt publication, including the different recovery rule once commit evidence may be durable. Those rules determine whether this same transaction may publish or must roll back; splitting them would make the transaction defer its own atomicity contract elsewhere. The earlier raise carries the after-image boundary, deferred-rerun exclusion, corrective-adoption asymmetry, lifecycle-position claims, and producer-era identity. The split condition is a routed consumer that enters one branch without holding the plan that selected it | | [[kernel/K12 Quality Assurance/15 Terminal Audit and Convergence\|Terminal Audit and Convergence]] | 6715 bytes | Its two sections are the Terminal Audit and the findings that audit produces. `#Terminal Audit` is anchored four times corpus-wide and the convergence rules decide nothing without the run that produced the findings, so separating them would leave each half deferring to the other | 7KB | Re-measure whenever a Terminal Audit review or a convergence rule is added; the split condition is a routed consumer that resolves a finding without having run the audit | | [[kernel/K12 Quality Assurance/16 Terminal Proof Contract\|Terminal Proof Contract]] | 11042 bytes | The proof contract, the gate that consumes it, and the trust boundary that scopes it are one answer to whether a task may close. Its single routed consumer, the Audit and Completion Read Set, loads all three | 11KB | Re-measure whenever a proof field or a gate item is added. Raised from 10KB to 11KB when Terminal Proof was required to consume one shared Profile/runtime view and bind/recheck the root-owned profile-load inputs alongside the Profile snapshot, typed contract, and exact repository snapshot later consumed by the completion writer. This is a currentness condition of the same proof. The earlier 9.5KB-to-10KB raise applies when root validation was required to rerun `profile-load` and keep its closure outside the five loaded-set lists. That is a condition of the existing proof, not a new proof object. The earlier raise carries the exact five-list binding. The next split MUST be `Evidence Trust Boundary`, the only part carrying an anchor of its own, once a routed consumer reaches it without the contract | -| [[kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract\|Gate Receipt Payload Contract]] | 10454 bytes | Gate identity fields, producer-specific additions, recording authority, and rejection are one current-authorization payload contract. R07 loads the page when a receipt is offered and needs all four to decide whether it authorizes the boundary | 10.5KB | Raised from 8.5KB to 10.5KB when current Gate authorization separated raw semantic leaves from their registered owners and required native owner member chains while preserving producer-era replay. These are acceptance and rejection rules of the same receipt payload, not a second payload contract. Raised from 7KB to 8.5KB when profile-load and Profile-derived Gate receipts gained their root-input and compiled-artifact and terminal repository fingerprints; these are producer-specific fields under the same shared acceptance/rejection contract. Originally registered when `profile-load` added its pre-Queue manifest identity plus Profile snapshot and typed-contract fingerprints. Those fields specialize the one payload contract and splitting them would create a second owner of what a Gate receipt carries. Re-measured to 10454 bytes when the batch-review wrapper gained its frozen judgment-set binding — the same one-wrapper contract, extended, not a second payload owner. Re-measure whenever a producer adds required authorization fields; split only when a routed consumer can validate one receipt class without the shared payload and rejection rules | +| [[kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract\|Gate Receipt Payload Contract]] | 10482 bytes | Gate identity fields, producer-specific additions, recording authority, and rejection are one current-authorization payload contract. R07 loads the page when a receipt is offered and needs all four to decide whether it authorizes the boundary | 10.5KB | Raised from 8.5KB to 10.5KB when current Gate authorization separated raw semantic leaves from their registered owners and required native owner member chains while preserving producer-era replay. These are acceptance and rejection rules of the same receipt payload, not a second payload contract. Raised from 7KB to 8.5KB when profile-load and Profile-derived Gate receipts gained their root-input and compiled-artifact and terminal repository fingerprints; these are producer-specific fields under the same shared acceptance/rejection contract. Originally registered when `profile-load` added its pre-Queue manifest identity plus Profile snapshot and typed-contract fingerprints. Those fields specialize the one payload contract and splitting them would create a second owner of what a Gate receipt carries. Re-measured to 10482 bytes when the batch-review wrapper gained its frozen judgment-set binding — the same one-wrapper contract, extended, not a second payload owner. Re-measure whenever a producer adds required authorization fields; split only when a routed consumer can validate one receipt class without the shared payload and rejection rules | | [[kernel/K12 Quality Assurance/14 Batch Review\|Batch Review]] | 7328 bytes | The two checklist groups and the wrapper's binding contract are one merge-ready boundary: the in-batch items say what a batch owes, and the wrapper paragraph says how the one consuming receipt proves it, now including the frozen Batch Review judgment set. A reader given either half would rebuild the other from prose | 7.5KB | Registered when the wrapper gained the judgment-set binding (`review_requirement_set_sha256`, `judgment_receipt_ids`, `judgment_record_set_sha256`) and the in-batch items gained the per-record `record_batch_judgment` obligation — the binding belongs beside the wrapper it extends and nowhere else. Re-measure when a wrapper field or in-batch item is added; split only when a routed consumer can validate the wrapper without the in-batch items that produce its members | | [[kernel/K13 Task Runtime and Execution Control/19 Card Context Activation and Read-back Delivery\|Card Context Activation and Read-back Delivery]] | 7226 bytes | The Bundle, the Frozen Review Plan, progressive read-back, and resume redelivery are one delivery boundary read at every activation; splitting the plan from the Bundle would let one recompile and not the other | 7.5KB | Registered when protocol v2 added the Frozen Review Plan section: the plan freezes at the same admission, recompiles at the same `queued -> open`, and is delivered in the same payload, so its contract belongs on the page that owns that boundary. Re-measure when the activation payload gains a commitment; split only when a consumer can validate one commitment without the shared delivery/era rules | | [[kernel/K13 Task Runtime and Execution Control/06 Amendment Log and Controlled Replanning\|Amendment Log and Controlled Replanning]] | 9557 bytes | The Guidance record, the Amendment state machine, and the registration/withdrawal writer contract are one log discipline: both routed consumers load the page whole to decide what a Guidance or operational change may do next, and no page anchors a section of it. The withdrawal rule that took the page over the cap belongs beside the one-pending rule it protects — a pending registration whose execution can never validate would otherwise wedge every future operational Amendment — and nowhere else. The Contract Amendment section joined for the same reason: the guarded writer for the one amendable contract field is part of the same discipline that says what an approved decision may and may not execute, and a reader deciding whether a contract change is amendable or successor-bound needs the whole state machine in hand | 9.5KB | Re-measure whenever an Amendment state, registration rule, or versioning rule is added; raised from 8KB to 9.5KB when the Task Contract gained a closed delegated-authority record, operational registration began deriving and binding its exact impact under lock, and narrow gap-route reconciliation received an explicit-user writer. These are authorization rules of the existing Amendment state machine. Earlier: re-measured at 8185 bytes when the Contract Amendment section gained the writer's own authorization conditions (effective-policy fingerprint, joint ceiling, merge-ready refusal) -- invocation rules of the same writer, not a new discipline. The cap moved from 7KB to 8KB when the Contract Amendment writer landed, under the same standing necessity. The split condition is a routed consumer that resolves a registration or withdrawal without holding the Guidance state machine it serves | diff --git a/kernel/K00 Standards Control/17 Profile Dependency Closure.md b/kernel/K00 Standards Control/17 Profile Dependency Closure.md index 83675dd..1ee2e34 100644 --- a/kernel/K00 Standards Control/17 Profile Dependency Closure.md +++ b/kernel/K00 Standards Control/17 Profile Dependency Closure.md @@ -54,7 +54,7 @@ passing evaluation as a compare value, not a lease. It MUST carry the same authorized in-process view through every proposed, locked, post-write, and receipt-producing check in one transaction, then compare the exact manifest, Profile-tree snapshot, typed-contract fingerprint, root-input fingerprint, -and approved K00/03 selection at each write boundary. A Profile-derived +and approved canonical adopter Standards state at each write boundary. A Profile-derived compiled artifact additionally MUST be byte-equal to the deterministic output of that view and bind its artifact fingerprint; provenance prose alone is not authorization. Initial runtime publication stages the shared writer lock in diff --git a/kernel/K00 Standards Overview.md b/kernel/K00 Standards Overview.md index 61af4ab..b2fc637 100644 --- a/kernel/K00 Standards Overview.md +++ b/kernel/K00 Standards Overview.md @@ -1,21 +1,19 @@ ## Purpose -This file is the sole overall entry point for the active Standards. It is responsible only for state slots, task routing, the Standard Module Index, and the loading protocol; detailed rules are maintained by folder-based leaf modules. +This file is the sole overall entry point for the active Standards. It is responsible only for governance-interface routing, the Standard Module Index, and the loading protocol; detailed rules are maintained by folder-based leaf modules. -## Current State +## Governance Interface -| Field | Value | +| Concern | Canonical owner | |---|---| -| Standards version | See [[kernel/K00 Standards Control/03 Standards Governance#Standards Control\|active Standards state]] | -| Status | See [[kernel/K00 Standards Control/03 Standards Governance#Standards Control\|active Standards state]] | -| Effective date | See [[kernel/K00 Standards Control/03 Standards Governance#Standards Control\|active Standards state]] | -| Selected profile manifest | See [[kernel/K00 Standards Control/03 Standards Governance#Standards Control\|active Standards state]] | +| Current adopter Standards/Profile identity | `.cambium/governance/standards_state.yaml`, under [[kernel/K00 Standards Control/03 Standards Governance#Standards State And Adoption History\|Standards Governance]] | +| Adoption history | `.cambium/receipts/standards-adoptions.jsonl`; append-only receipts, never Kernel or Card chronology | | Standard module MOCs | `derived-from-active-kernel-module-registry` | | Canonical leaf modules | `derived-from-active-kernel-inventory` | | Routing model | Kernel Runtime Cards (Card-first) + Read Sets escalation read-back + Triggered / Gate Modules | | Change authority | User's explicit governance instruction | -The complete state rules are maintained by [[kernel/K00 Standards Control/03 Standards Governance|Standards Governance]]. +The complete state and history separation rules are maintained by [[kernel/K00 Standards Control/03 Standards Governance|Standards Governance]]. ## Start Here @@ -75,7 +73,7 @@ Detailed task combinations are located in [[kernel/K00 Standards Control/02 Task |---|---| | [[kernel/K00 Standards Control/01 Operating Role and Reading Protocol\|Operating Role and Reading Protocol]] | execution role, Card-first loading, and source read-back | | [[kernel/K00 Standards Control/02 Task Routing\|Task Routing]] | task-to-route combinations only | -| [[kernel/K00 Standards Control/03 Standards Governance\|Standards Governance]] | active adopter state and governance change process | +| [[kernel/K00 Standards Control/03 Standards Governance\|Standards Governance]] | governance process and the external adopter-state contract | | [[kernel/K00 Standards Control/04 Control State and Scope\|Control State and Scope]] | protected control state and modification authority | | [[kernel/K00 Standards Control/05 Core Principles\|Core Principles]] | universal knowledge-corpus principles | | [[kernel/K00 Standards Control/06 Completion Precedence and Task Contract\|Completion Precedence and Task Contract]] | precedence, contract, and selected completion semantics | diff --git a/kernel/K12 Quality Assurance/05 Automated and Manual Checks.md b/kernel/K12 Quality Assurance/05 Automated and Manual Checks.md index 94a8f5d..2a12d19 100644 --- a/kernel/K12 Quality Assurance/05 Automated and Manual Checks.md +++ b/kernel/K12 Quality Assurance/05 Automated and Manual Checks.md @@ -42,7 +42,7 @@ The following domain-specific check items run only on the changed / invalidated - Mermaid compile, asset path, deterministic rendering evidence, and `rendering_mode` enumeration checks. - Level 2–4 records MUST include visual trigger, unresolved question, target, and result; a batch without a trigger requires no visual evidence. - Cross-file duplicate block detection — run a paragraph-level similarity scan with `Tools/duplicate_check.py`; similar paragraph pairs are reported as candidates, with manual judgment on whether they violate the [[kernel/K00 Standards Control/11 Standards Map and Rule Registry#Cross-domain Rule Registry|Cross-domain Rule Registry]]. Run only in maintenance runs and governance tasks; at the batch level only the basename-level detection in the Closed List is kept. -- Terminal Proof completeness and zero-value condition validation (canonical definition in [[kernel/K12 Quality Assurance/16 Terminal Proof Contract#Terminal Proof Contract|Terminal Proof Contract]]) — implemented as `Tools/check_proof.py`; terminal mode reconciles the frozen Standards version and selected profile against the active K00/03 state and Progress Ledger, and MUST reconcile Required gaps with the current Coverage Ledger. +- Terminal Proof completeness and zero-value condition validation (canonical definition in [[kernel/K12 Quality Assurance/16 Terminal Proof Contract#Terminal Proof Contract|Terminal Proof Contract]]) — implemented as `Tools/check_proof.py`; terminal mode reconciles the frozen Standards version and selected Profile against the canonical adopter Standards state and Progress Ledger, and MUST reconcile Required gaps with the current Coverage Ledger. - Knowledge freshness check — `Tools/check_freshness.py` computes `review_by` only from a temporally valid baseline and resolved volatility, and outputs the complete freshness candidate set for maintenance runs. That set is not limited to overdue pages: it preserves content-modified-since-review, awaiting-first-verification, invalid or future explicit event, invalid or unresolved volatility, and unparseable-frontmatter candidates. Maintenance-run only; not run in batch checks. Freshness semantics and the closed-world pass rule are owned by [[kernel/K08 Metadata and Status/05 Review Source and Migration Metadata|Review Source and Migration Metadata]]; fusion and budget order are owned by [[kernel/K00 Standards Control/08 Maintenance Run Envelope|Maintenance Run Envelope]]. Profile-registered automated checks may produce results only within their registered candidate boundary and acceptance predicate; candidate scans MUST NOT fail items directly. No automated check can replace content review. diff --git a/kernel/K12 Quality Assurance/10 Standards Version Adoption.md b/kernel/K12 Quality Assurance/10 Standards Version Adoption.md index ea2aba3..dd7e8d9 100644 --- a/kernel/K12 Quality Assurance/10 Standards Version Adoption.md +++ b/kernel/K12 Quality Assurance/10 Standards Version Adoption.md @@ -7,14 +7,16 @@ ## Purpose And Sole Ownership This module solely owns active-task Standards adoption: changed-predicate -impact, invalidated evidence, and gate reruns when materialized task identity differs -from K00/03. R09 owns the revision; [[kernel/K13 Task Runtime and Execution Control/15 Standards Adoption State Transaction|K13/15]] +impact, invalidated evidence, and gate reruns when materialized task identity +differs from the canonical adopter Standards state. R09 owns the revision; +[[kernel/K13 Task Runtime and Execution Control/15 Standards Adoption State Transaction|K13/15]] owns the write transaction. Pre-Task initial adoption belongs to R09. ## Trigger And Invariants -Batch activation, resume, and completion entry compare K00/03 with the Contract -and three state objects. Mismatch blocks normal work until adoption commits. +Batch activation, resume, and completion entry compare +`.cambium/governance/standards_state.yaml` with the Contract and three task +state objects. Mismatch blocks normal work until adoption commits. Only `active` or `paused` may adopt; stale `completion-candidate` first returns through K13/03. @@ -42,8 +44,10 @@ state table is allowed. Exact top-level fields: schema_version, adoption_id, task_id, task_state_before, contract_version_before, contract_version_after, standards_version_before, standards_version_after, +standards_effective_date_after, standards_state_sha256_before, selected_profile_manifest_before, selected_profile_manifest_after, governance_revision_ref, governance_revision_sha256, +upstream_source_ref, upstream_revision_id, standards_snapshot_sha256_after, profile_snapshot_sha256_after, profile_contract_fingerprint_after, profile_load_inputs_sha256_after, selected_route_ids_after, selected_card_paths_after, @@ -154,7 +158,9 @@ bumps `contract_version`; a pure identity no-op may retain it. `governance_revision_ref` is exactly `kernel/K00 Standards Control/03 Standards Governance.md`; its SHA binds all -approved bytes, whose active version/Profile equal the plan after identity. +approved governance-rule bytes. The separate +`standards_state_sha256_before` binds the current adopter identity, and +`standards_effective_date_after` becomes the next state's effective date. After snapshot SHAs deterministically bind all `kernel/` and the selected Profile directory. The 1.3 producer persists the exact typed dependency graph as `profile_contract_fingerprint_after`; the 1.4 producer additionally @@ -196,7 +202,7 @@ publishing that candidate result into the current Queue receipt identity. On apply, the writer MUST rerun full `profile-load` and compare all three under the shared lock before the first write, after the state writes, and immediately before and after final receipt publication. Pre-commit drift restores the -three before images and records abort. If commit evidence may already be +four before images and records abort. If commit evidence may already be durable, rollback still restores those state bytes and records abort, but the writer lock remains for explicit reconciliation. @@ -260,8 +266,9 @@ capability table. Only `Tools/adopt_standards.py` applies the plan. Commit proves: -1. three-state after identity and Progress after load set agree; -2. Progress appends one entry binding plan, three before SHAs, after +1. adopter Standards state and three-task-state after identity agree, and the + Progress after load set is complete; +2. Progress appends one entry binding plan, four before SHAs, after Coverage/Queue SHAs, and immediate-gate receipt; only commit receipt binds the self-containing after Progress SHA; 3. Queue/Progress revision advanced once and all invariants above held; diff --git a/kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md b/kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md index 589a730..ca772e7 100644 --- a/kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md +++ b/kernel/K12 Quality Assurance/17 Gate Receipt Payload Contract.md @@ -8,7 +8,7 @@ This module owns one object: what a receipt MUST carry to be consumed as current authorization for a Gate ID, and who may record one when the registered producer is `manual-attestation`. Those receipts are written by a person or an agent rather than emitted by a script, so without this contract their producer has no statement of the fields the consumer compares, and learns the payload only from a rejection. -It states no field meaning, no reuse or invalidation rule, and no receipt dimension: those stay with [[kernel/K12 Quality Assurance/07 Audit Evidence Reuse and Invalidation#Dimension-specific Audit Receipt|K12/07]]. The Gate ID and its producer tuple stay with [[kernel/K00 Standards Control/12 Control Registry#Control Registry|Control Registry]]. The identity values are read from the canonical Required Queue owned by [[kernel/K13 Task Runtime and Execution Control/08 Required Queue Contract and Lifecycle|K13/08]] and the active Standards state of [[kernel/K00 Standards Control/03 Standards Governance#Standards Control|K00/03]]. This module adds no Gate ID and no judgment item. +It states no field meaning, no reuse or invalidation rule, and no receipt dimension: those stay with [[kernel/K12 Quality Assurance/07 Audit Evidence Reuse and Invalidation#Dimension-specific Audit Receipt|K12/07]]. The Gate ID and its producer tuple stay with [[kernel/K00 Standards Control/12 Control Registry#Control Registry|Control Registry]]. The identity values are read from the canonical Required Queue owned by [[kernel/K13 Task Runtime and Execution Control/08 Required Queue Contract and Lifecycle|K13/08]] and the canonical adopter state defined by [[kernel/K00 Standards Control/03 Standards Governance#Standards State And Adoption History|K00/03]]. This module adds no Gate ID and no judgment item. ## Gate Receipt Payload diff --git a/kernel/K13 Task Runtime and Execution Control/01 Runtime State Model and Namespace.md b/kernel/K13 Task Runtime and Execution Control/01 Runtime State Model and Namespace.md index a5b7d50..dbc8f2d 100644 --- a/kernel/K13 Task Runtime and Execution Control/01 Runtime State Model and Namespace.md +++ b/kernel/K13 Task Runtime and Execution Control/01 Runtime State Model and Namespace.md @@ -9,19 +9,23 @@ Persistent, resumable, multi-batch, R07, or R11 work uses: ```text .cambium/ + governance/standards_state.yaml state/{coverage_ledger.yaml,required_queue.yaml,progress_ledger.yaml} work_specs/ deltas/ receipts/ reports/ tmp/ ``` -State, Work Specs, deltas, and receipts are durable; `deltas/` also contains +Governance state and Standards-adoption receipts may exist before any task +runtime. Task state, Work Specs, deltas, and receipts are durable; `deltas/` +also contains restricted-YAML controlled-operation plans such as active-task Standards adoption. Reports are derived, and managed paths stay repository-contained. `work_specs/` contains only immutable restricted-YAML contracts for complex batches, each bound by path and SHA-256 from Coverage `batch_specs` and the compiled Required Queue. It is not a second -Queue, task ledger, or general documentation directory. Initialize only when -`.cambium/` is absent; -otherwise run `check_queue.py --resume-status` before any write and follow its +Queue, task ledger, or general documentation directory. Initialize task state +only when `.cambium/state/` is absent; `init_state.py` preserves a valid +governance-only parent namespace. Otherwise run +`check_queue.py --resume-status` before any write and follow its machine `next_action`. Bounded work needs no empty Queue. A lock remains until the state SHAs, receipts, deltas/archive moves, and absence of a live writer reconcile. New tasks archive rather than repurpose existing state. diff --git a/kernel/K13 Task Runtime and Execution Control/14 Interruption Recovery and Rollover.md b/kernel/K13 Task Runtime and Execution Control/14 Interruption Recovery and Rollover.md index 703e447..e03bdf1 100644 --- a/kernel/K13 Task Runtime and Execution Control/14 Interruption Recovery and Rollover.md +++ b/kernel/K13 Task Runtime and Execution Control/14 Interruption Recovery and Rollover.md @@ -33,9 +33,10 @@ unused—the first runtime action is: python3 Tools/check_queue.py . --resume-status ``` -If `.cambium/` is absent, there is no persistent state to resume and an -authorized task may initialize it. If it exists, `init_state.py` MUST NOT be -used to replace it. The status view identifies the recorded task and profile, +If `.cambium/state/` is absent, there is no persistent task state to resume and +an authorized task may initialize it beside any valid governance/history +namespace. If task state exists, `init_state.py` MUST NOT be used to replace +it. The status view identifies the recorded task and Profile, task state/checkpoint, Queue revisions and fingerprint, lifecycle groups, Work Spec bindings, holds, pending deltas, writer locks, latest task transition, pending Guidance or Amendments, Terminal Audit state, and one machine-readable `next_action`. diff --git a/kernel/K13 Task Runtime and Execution Control/15 Standards Adoption State Transaction.md b/kernel/K13 Task Runtime and Execution Control/15 Standards Adoption State Transaction.md index f3a92eb..2ea95ee 100644 --- a/kernel/K13 Task Runtime and Execution Control/15 Standards Adoption State Transaction.md +++ b/kernel/K13 Task Runtime and Execution Control/15 Standards Adoption State Transaction.md @@ -20,6 +20,9 @@ and writes only with `--apply --actor-role integrator`. The writer may change only: +- the canonical adopter Standards state: current Standards/Profile identity, + approval/effective-date and upstream provenance, latest adoption receipt, + and exactly one `state_revision` increment; - `standards_version` and `selected_profile_manifest` in Coverage and Queue; - those identity fields and, when K12/10 requires it, `contract_version` in the Progress Task Contract; @@ -30,10 +33,10 @@ The writer may change only: `selected_profile_route_ids`, `selected_read_sets`, and `loaded_module_paths`; and - one append-only Progress `standards_adoptions` entry binding the plan, - transaction receipt, before/after identities and load set, all three before - SHAs, the after Coverage/Queue SHAs, and the immediate-gate receipt. It + transaction receipt, before/after identities and load set, all four before + SHAs, the after Coverage/Queue/Standards-state SHAs, and the immediate-gate receipt. It cannot contain its own after Progress SHA; only the commit receipt binds the - complete three-file after image. + complete four-file after image. Everything else must remain byte-semantically unchanged. In particular, the writer cannot change task state, contract objective/scope/completion @@ -46,9 +49,10 @@ batch structure. ## Guarded Write Protocol -Before writing, the tool reparses the plan and all three canonical state -objects, validates the K12/10 branch, and compare-and-swaps the plan's exact -task state, Standards/Profile identity, Queue revisions, and three before +Before writing, the tool reparses the plan, the three task Ledgers, and the +canonical adopter Standards state, validates the K12/10 branch, and +compare-and-swaps the plan's exact +task state, Standards/Profile identity, Queue revisions, and four before SHA-256 values, plus `queue_revision_after = queue_revision_before + 1`. Only `active` and `paused` tasks may adopt. A stale plan, unknown field, unresolvable after load set, current writer @@ -57,7 +61,7 @@ affected `merge-ready` batch, affected `open` batch without `revalidation-required`, pending state write, or any requested change outside the permitted transaction fails closed. -All three canonical state objects must already satisfy the current schema, +All four canonical state objects must already satisfy the current schema, including an explicit Progress `standards_adoptions` list. Missing or malformed current fields fail closed; schema migration is not Standards adoption. @@ -65,21 +69,21 @@ The writer then: 1. acquires the shared state-writer lock; 2. records a `prepare` receipt and the exact before/planned-after fingerprints; -3. stages and reparses all three complete after documents; +3. stages and reparses all four complete after documents; 4. publishes each file by same-directory atomic replacement while retaining enough lock evidence to diagnose a partial multi-file write; 5. runs and consumes the plan's sole immediate `required-queue-consistency` gate against the staged after image; 6. revalidates cross-state identity, unchanged lifecycle/state revision, the one structural Queue revision increment, and exact after fingerprints; and -7. appends one `commit` receipt, including all three after SHAs, to +7. appends one `commit` receipt, including all four after SHAs, to `.cambium/receipts/standards-adoptions.jsonl` before releasing the lock. The commit receipt also chains the before and after Task Contract anchors. A task-transition receipt created under the old contract remains historical evidence and cannot be treated as if it authenticated the new contract bytes. -The filesystem operation is not falsely described as one atomic three-file +The filesystem operation is not falsely described as one atomic four-file write. An ordinary pre-commit failure rolls back to the frozen before images and appends an `abort` receipt. If rollback or a receipt append is uncertain, the lock remains with both before and planned-after fingerprints; it is @@ -94,7 +98,7 @@ and historical-verification meaning. At restart, R07 first uses `check_queue.py --resume-status`. An adoption lock or prepare receipt without a matching current commit takes precedence over -batch execution. The integrator reconciles the plan SHA, lock owner, all three +batch execution. The integrator reconciles the plan SHA, lock owner, all four current state SHA-256 values, and the prepare/commit/abort chain before removing the lock or retrying. A committed adoption resumes per K12/10 without another state rewrite. diff --git a/kernel/Read Sets/R01 Core Bootstrap Read Set.md b/kernel/Read Sets/R01 Core Bootstrap Read Set.md index d4da737..74a8cf0 100644 --- a/kernel/Read Sets/R01 Core Bootstrap Read Set.md +++ b/kernel/Read Sets/R01 Core Bootstrap Read Set.md @@ -12,7 +12,7 @@ Core Bootstrap is the minimal common read set for all Knowledge Base Standards t Read in order: 1. [[kernel/K00 Standards Overview|Standards Overview]] -2. [[kernel/K00 Standards Control/03 Standards Governance#Standards Control|Standards Control]] +2. [[kernel/K00 Standards Control/03 Standards Governance#Standards State And Adoption History|Standards State And Adoption History]] 3. [[kernel/K00 Standards Control/02 Task Routing|Task Routing]] 4. [[kernel/K00 Standards Control/13 Runtime Admission and Recovery|Runtime Admission and Recovery]] 5. [[kernel/K00 Standards Control/04 Control State and Scope|Control State and Scope]] diff --git a/kernel/Read Sets/R09 Standards Governance Read Set.md b/kernel/Read Sets/R09 Standards Governance Read Set.md index cee0588..5611b84 100644 --- a/kernel/Read Sets/R09 Standards Governance Read Set.md +++ b/kernel/Read Sets/R09 Standards Governance Read Set.md @@ -39,10 +39,10 @@ First read: ## Required Controls - The user MUST explicitly authorize the governance change. -- Before a later revision, freeze the active Standards version and selected profile manifest. For initial adoption, freeze the four uninstantiated K00/03 state values and the upstream tag, commit, or archive checksum instead; an old profile does not exist and is not a prerequisite. In both branches, freeze affected modules, incoming links, and active task impact. -- Initial profile selection and every later selection change occur only here. Initial adoption validates the candidate through the canonical `profile-load` Gate, instantiates all four K00/03 state values, and creates the first Change Summary entry. A later change validates the after candidate through the same Gate, records old and new selections, and bumps `standards_version`. Both branches recompose vocabulary and stamp Cards. For each existing affected runtime task, R09 freezes the authorized revision identity and changed predicates and produces the K12/10 restricted-YAML adoption input; it does not edit that task's Coverage, Queue, or Progress. Predicate, Profile-path, Profile-contract, or resolved-load-set change also requires a new Task `contract_version`; a pure no-predicate-change identity update may keep it. +- Before a later revision, freeze the exact canonical adopter Standards state bytes. For initial adoption, prove that state file is absent and freeze the upstream tag, commit, or archive checksum instead; an old profile does not exist and is not a prerequisite. In both branches, freeze affected modules, incoming links, and active task impact. +- Initial profile selection and every later selection change occur only here. Initial adoption validates the candidate through the canonical `profile-load` Gate, creates `.cambium/governance/standards_state.yaml`, and appends the first adoption receipt. A later change validates the after candidate through the same Gate, advances the state, and appends another receipt; it never grows a Kernel or Card history table. Both branches recompose vocabulary and stamp Cards. For each existing affected runtime task, R09 freezes the authorized revision identity and changed predicates and produces the K12/10 restricted-YAML adoption input; it does not directly edit that task's Coverage, Queue, or Progress. Predicate, Profile-path, Profile-contract, or resolved-load-set change also requires a new Task `contract_version`; a pure no-predicate-change identity update may keep it. - If the revised Standards cannot parse or validate a currently bound Work Spec, complete that compatibility migration through the Work Spec's owning process before producing an admissible adoption plan. R09 cannot hide it inside the adoption transaction. -- Bind each plan to the complete approved K00/03 bytes and deterministic after snapshots of the `kernel/` tree and selected Profile directory. A `profile-load` boundary targets exactly `selected_profile_manifest_after`; admission binds the passing Profile snapshot and contract fingerprint before any runtime write. The derived Profile closure remains separate from `selected_read_sets` and `loaded_module_paths`. Its changed predicates are that task's canonical machine list; do not create a second revision YAML or prose adoption copy. +- Bind each plan to the complete approved K00/03 rule bytes, the exact canonical Standards-state before-image, and deterministic after snapshots of the `kernel/` tree and selected Profile directory. A `profile-load` boundary targets exactly `selected_profile_manifest_after`; admission binds the passing Profile snapshot and contract fingerprint before any runtime write. The derived Profile closure remains separate from `selected_read_sets` and `loaded_module_paths`. Its changed predicates are that task's canonical machine list; do not create a second revision YAML or prose adoption copy. - A structural migration MUST establish a complete mapping from old content blocks to new owners. - A split MUST NOT be used as reduction, summarization, or silent deletion of rules. - Read Sets and the overall Index MUST stay synchronized with module paths. diff --git a/kernel/Read Sets/R10 Maintenance Run Read Set.md b/kernel/Read Sets/R10 Maintenance Run Read Set.md index fca41ba..5312e67 100644 --- a/kernel/Read Sets/R10 Maintenance Run Read Set.md +++ b/kernel/Read Sets/R10 Maintenance Run Read Set.md @@ -22,10 +22,11 @@ First read [[kernel/Read Sets/R01 Core Bootstrap Read Set|Core Bootstrap]], then Before starting, the budget envelope MUST be declared (N pages, N batches, or N hours — choose one of the three), and the candidate manifest merged from four sources: complete freshness candidate set ∪ watermark increment ∪ `needs_rereview` marks ∪ candidates pool (duplicate / vocab / language). Consume every freshness `candidate` outcome; do not filter the source back to overdue pages or treat an unresolved active page as absent. A candidate not selected by the budget for 3 consecutive maintenance runs is automatically demoted to log-only, and re-enters the pool when hit again by a new scan; at the start of a maintenance run, output the deferred age distribution, and items lingering more than 3 runs MUST be explicitly dispositioned. The owner of fusion, ordering, and deferral is [[kernel/K00 Standards Control/08 Maintenance Run Envelope|K00/08]]; freshness outcome semantics remain in [[kernel/K08 Metadata and Status/05 Review Source and Migration Metadata|K08/05]]. This Read Set is an execution summary. -Before any write, probe the adopting repository for `.cambium/`. If it exists, -resume its recorded task through `check_queue.py --resume-status`; do not -initialize or overwrite it. If it is absent, initialize only when this run is -persistent, resumable, or multi-batch, and declare +Before any write, probe the adopting repository for `.cambium/state/`. If it +exists, resume its recorded task through `check_queue.py --resume-status`; do +not initialize or overwrite it. If task state is absent, initialize only when +this run is persistent, resumable, or multi-batch, preserving any canonical +governance/history already under `.cambium/`, and declare `--completion-semantics maintenance`. A bounded single-note maintenance run does not create an empty runtime namespace merely to use R10. diff --git a/kernel/Read Sets/R11 Large-scale Work Admission Read Set.md b/kernel/Read Sets/R11 Large-scale Work Admission Read Set.md index 242b207..a94650c 100644 --- a/kernel/Read Sets/R11 Large-scale Work Admission Read Set.md +++ b/kernel/Read Sets/R11 Large-scale Work Admission Read Set.md @@ -38,7 +38,7 @@ Also load the route for the actual work. R11 never replaces that route. ## Admission Gate -Every item in the canonical [[kernel/K00 Standards Control/13 Runtime Admission and Recovery#Large-scale Pre-execution Gate|Large-scale Pre-execution Gate]] MUST be resolved. State is initialized only when `.cambium/` is absent; if it exists, `python3 Tools/check_queue.py . --resume-status` is the first state action and the recorded task must be reconciled rather than overwritten. The configured Corpus Planning artifacts pass `check_corpus_plan.py`; the Queue manifest and Coverage projection agree; and `check_queue.py .` plus `--require-ready ` pass before execution. At task start only the Audit Receipt Register is loaded; an AuditPlan is built exactly once before batch close. When any admission condition is missing, remain in planning or investigation. +Every item in the canonical [[kernel/K00 Standards Control/13 Runtime Admission and Recovery#Large-scale Pre-execution Gate|Large-scale Pre-execution Gate]] MUST be resolved. Task state is initialized only when `.cambium/state/` is absent; if it exists, `python3 Tools/check_queue.py . --resume-status` is the first state action and the recorded task must be reconciled rather than overwritten. A governance-only `.cambium/` parent is preserved, not treated as a task. The configured Corpus Planning artifacts pass `check_corpus_plan.py`; the Queue manifest and Coverage projection agree; and `check_queue.py .` plus `--require-ready ` pass before execution. At task start only the Audit Receipt Register is loaded; an AuditPlan is built exactly once before batch close. When any admission condition is missing, remain in planning or investigation. ## Related diff --git a/profiles/examples/agent-atlas/README.md b/profiles/examples/agent-atlas/README.md index 4251e9b..545cf64 100644 --- a/profiles/examples/agent-atlas/README.md +++ b/profiles/examples/agent-atlas/README.md @@ -81,7 +81,7 @@ Exit 2 means the scan produced candidates for the registered judgment item. It i ## Validation Provenance -The public Cambium distribution is intentionally uninstantiated: `kernel/K00 Standards Control/03 Standards Governance.md` still carries `{{ standards_version }}`, so there is no released version string for an example to declare. The machine-checkable stand-in is the validating tool version below. Re-run every command in this table — and update the versions — after any Standards revision, interface change, or tool bump; `Tools/tests/test_profile_examples.py` enforces exactly this table. +The public Cambium distribution is intentionally uninstantiated: it carries no `.cambium/governance/standards_state.yaml`, so there is no adopter version string for an example to declare. The machine-checkable stand-in is the validating tool version below. Re-run every command in this table — and update the versions — after any Standards revision, interface change, or tool bump; `Tools/tests/test_profile_examples.py` enforces exactly this table. | Validator | Tool version | Command | Expected result | |---|---|---|---| diff --git a/profiles/examples/minimal-notes/README.md b/profiles/examples/minimal-notes/README.md index 81423ed..4b55310 100644 --- a/profiles/examples/minimal-notes/README.md +++ b/profiles/examples/minimal-notes/README.md @@ -58,7 +58,7 @@ The verifier command in [registries/registered-scans.md](registries/registered-s ## Validation Provenance -The public Cambium distribution is intentionally uninstantiated: `kernel/K00 Standards Control/03 Standards Governance.md` still carries `{{ standards_version }}`, so there is no released version string for an example to declare. The machine-checkable stand-in is the validating tool version below. Re-run every command in this table — and update the versions — after any Standards revision, interface change, or tool bump; `Tools/tests/test_profile_examples.py` enforces exactly this table. +The public Cambium distribution is intentionally uninstantiated: it carries no `.cambium/governance/standards_state.yaml`, so there is no adopter version string for an example to declare. The machine-checkable stand-in is the validating tool version below. Re-run every command in this table — and update the versions — after any Standards revision, interface change, or tool bump; `Tools/tests/test_profile_examples.py` enforces exactly this table. | Validator | Tool version | Command | Expected result | |---|---|---|---| diff --git a/profiles/examples/worked-planning/README.md b/profiles/examples/worked-planning/README.md index 5096fe5..9d643fd 100644 --- a/profiles/examples/worked-planning/README.md +++ b/profiles/examples/worked-planning/README.md @@ -54,7 +54,7 @@ The verifier command in [registries/registered-scans.md](registries/registered-s ## Validation Provenance -The public Cambium distribution is intentionally uninstantiated: `kernel/K00 Standards Control/03 Standards Governance.md` still carries `{{ standards_version }}`, so there is no released version string for an example to declare. The machine-checkable stand-in is the validating tool version below. Re-run every command in this table — and update the versions — after any Standards revision, interface change, or tool bump; `Tools/tests/test_profile_examples.py` enforces exactly this table. +The public Cambium distribution is intentionally uninstantiated: it carries no `.cambium/governance/standards_state.yaml`, so there is no adopter version string for an example to declare. The machine-checkable stand-in is the validating tool version below. Re-run every command in this table — and update the versions — after any Standards revision, interface change, or tool bump; `Tools/tests/test_profile_examples.py` enforces exactly this table. | Validator | Tool version | Command | Expected result | |---|---|---|---| From 89547fd50543cab8bc617e3f590d099ff9231b71 Mon Sep 17 00:00:00 2001 From: KimGLee <05_bolster_inkling@icloud.com> Date: Sat, 22 Aug 2026 00:14:13 +0800 Subject: [PATCH 2/4] Update profile flow fixtures for governance state --- Tools/tests/test_apply_task_plan.py | 1 + Tools/tests/test_profile_flow_e2e.py | 22 ++++++++++++---------- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/Tools/tests/test_apply_task_plan.py b/Tools/tests/test_apply_task_plan.py index f8bb536..a3a294f 100644 --- a/Tools/tests/test_apply_task_plan.py +++ b/Tools/tests/test_apply_task_plan.py @@ -176,6 +176,7 @@ def setUp(self): for relative, text in ((READ_SET, READ_SET_TEXT), (CARD, CARD_TEXT), (OTHER_CARD, CARD_TEXT), (R01_READ_SET, READ_SET_TEXT), + (MODULE, "# Fixture Standards Governance\n"), (CARD_INDEX, CARD_INDEX_TEXT), (READ_SET_INDEX, READ_SET_INDEX_TEXT)): path = self.root / relative diff --git a/Tools/tests/test_profile_flow_e2e.py b/Tools/tests/test_profile_flow_e2e.py index 103ad2e..9c3d3b8 100644 --- a/Tools/tests/test_profile_flow_e2e.py +++ b/Tools/tests/test_profile_flow_e2e.py @@ -15,8 +15,8 @@ check_profile -> R09 initial adoption -> bounded founding -> candidate preparation -> R09 revision -> init_state -> apply_task_plan -> compile_queue), asserting at every stage which writer owns which bytes - and that founding/adoption create no `.cambium/`, no Coverage, and no - Queue. + and that founding/adoption create governance state but no task runtime, + Coverage, or Queue. B. Lifecycle text pins across the English and Chinese READMEs, the profiles docs, and the kernel — the anti-drift net for the flow's load-bearing sentences (no `cp -R` teaching, no "first batch" language, candidate @@ -176,10 +176,11 @@ def run_check_profile(root, profile_id): def runtime_offenders(root): - """Every `.cambium/` directory or canonical runtime state file anywhere.""" + """Every task-runtime directory or canonical task-state file anywhere.""" offenders = [] for path in sorted(Path(root).rglob("*")): - if path.name == ".cambium" and path.is_dir(): + if (path.name == "state" and path.is_dir() and + path.parent.name == ".cambium"): offenders.append(path.relative_to(root).as_posix()) elif path.is_file() and path.name in RUNTIME_STATE_FILES: offenders.append(path.relative_to(root).as_posix()) @@ -639,9 +640,9 @@ def tearDownClass(cls): def test_initial_adoption_creates_no_runtime_and_no_coverage(self): self.assertEqual( [], self.offenders_after_initial, - "R09 initial adoption wrote runtime state; adoption is a " - "control-plane change and any .cambium/, Coverage, or Queue " - "it creates would predate the user-confirmed Task Plan") + "R09 initial adoption wrote task-runtime state; governance state " + "and history may precede a Task Plan, but Coverage and Queue may " + "not") self.assertEqual("found-empty-corpus", self.status_before_founding["next_action"]) self.assertEqual("adopted", @@ -758,7 +759,7 @@ def test_no_coverage_exists_after_either_adoption_branch(self): self.assertEqual( [], self.offenders_after_revision, "an adoption branch (initial or profile-revision) produced " - "runtime state or a Coverage/Queue file; Coverage rows may " + "task-runtime state or a Coverage/Queue file; Coverage rows may " "appear only through init_state + apply_task_plan with a " "user-confirmed Task Plan") @@ -783,6 +784,7 @@ def setUpClass(cls): (ttp.OTHER_CARD, ttp.CARD_TEXT), (ttp.R01_CARD, ttp.CARD_TEXT), (ttp.R01_READ_SET, ttp.READ_SET_TEXT), + (ttp.MODULE, "# Fixture Standards Governance\n"), (ttp.CARD_INDEX, ttp.CARD_INDEX_TEXT), (ttp.READ_SET_INDEX, ttp.READ_SET_INDEX_TEXT)): path = root / relative @@ -935,7 +937,7 @@ def test_status_prefers_resume_over_a_fresh_passing_candidate(self): with tempfile.TemporaryDirectory() as tmp: root = tpos.make_root(tmp) tpos.fill_candidate(root) - (root / ".cambium").mkdir() + (root / ".cambium" / "state").mkdir(parents=True) code, view, _ = tpos.run_status_json( root, "--profile-id", tpos.FILLED_ID) self.assertEqual(0, code) @@ -947,7 +949,7 @@ def test_status_prefers_resume_over_a_fresh_passing_candidate(self): "precedence claim is actually exercised") self.assertEqual( "resume-existing-task", view["next_action"], - "a passing candidate must not outrank .cambium/; " + "a passing candidate must not outrank .cambium/state/; " "onboarding over live runtime state is how a half-done " "task gets silently orphaned") From cec98d0a7f36cda8f8333f6f2c3b034567d7a8fc Mon Sep 17 00:00:00 2001 From: KimGLee <05_bolster_inkling@icloud.com> Date: Sat, 22 Aug 2026 00:27:33 +0800 Subject: [PATCH 3/4] Close Standards recovery and inventory gaps --- Tools/README.md | 10 +++++++++- Tools/check_queue.py | 9 ++++++++- Tools/compiled/cli-contract.yaml | 4 ++-- Tools/compiled/host-configs/claude-code.mcp.json | 2 +- Tools/compiled/host-configs/codex.config.toml | 4 ++-- Tools/compiled/host-configs/dsh-profile-patch.yaml | 2 +- Tools/compiled/host-configs/dsh.env | 4 ++-- Tools/compiled/host-configs/kimi-code.mcp.json | 2 +- Tools/compiled/mcp-tools.json | 2 +- Tools/compiled/metadata-execution-contract.json | 2 +- Tools/tests/test_apply_delta_runtime.py | 3 ++- 11 files changed, 30 insertions(+), 14 deletions(-) diff --git a/Tools/README.md b/Tools/README.md index 46b23f1..28453cc 100644 --- a/Tools/README.md +++ b/Tools/README.md @@ -39,6 +39,7 @@ The core distribution tools are `check_links`, `check_vocab`, `check_moc`, `update_queue`, `register_amendment`, `apply_amendment`, `adopt_standards`, `seal_receipts`, `apply_profile_adoption`, +`migrate_standards_state`, `render_queue`, `apply_delta`, `compose_vocab`, `check_profile`, `check_structure`, `compose_page_contract`, `check_page_contract`, `check_boundary_contract`, `render_boundary_projection`, @@ -51,6 +52,7 @@ The core distribution tools are `check_links`, `check_vocab`, `check_moc`, `mcp_server`, `card_activation`, `amendment_policy`, `batch_settlement`, `candidate_lifecycle`, `coverage_delta`, `freshness_engine`, `maintenance_candidates`, and `kblib`. +The shared canonical-state library is `standards_state`. `check_freshness` and `duplicate_check` are maintenance-run tools. This list and the inventory table below name every `Tools/*.py` file shipped with Cambium; a script absent from both is not part of the distribution. @@ -101,6 +103,7 @@ returned Addendum is bound to the parent Bundle and refuses source drift. | `profile_onboarding_status.py` | Read-only onboarding status projector 1.1.0: derives one machine-readable `next_action` from the presence/validity of `.cambium/governance/standards_state.yaml`, candidate Profile admission, corpus state, and `.cambium/state/` task-runtime presence. A governance-only `.cambium/` is pre-runtime state, not a task to resume. It writes nothing and owns no ledger | `python3 Tools/profile_onboarding_status.py . --json` | | `apply_profile_adoption.py` | Sole no-task-runtime R09 Profile-adoption writer 2.0.0. Initial adoption creates `.cambium/governance/standards_state.yaml`; a pre-task Profile revision advances it. The plan binds unchanged K00/03 rule bytes, the absent/current state, upstream identity, and exact `profile-load` evidence. The transaction appends `.cambium/receipts/standards-adoptions.jsonl`, regenerates vocabulary/page-contract/Cards, and rolls back every touched byte on failure. It never adds history to Kernel Markdown or Cards; an existing `.cambium/state/` routes to `adopt_standards.py` | `python3 Tools/apply_profile_adoption.py . --plan adoption-plans/PA-001.yaml --apply` | | `migrate_standards_state.py` | One-time compatibility bridge 1.0.0 for an existing task runtime whose current Standards/Profile identity is still repeated only across Coverage, Queue, and Progress. It requires those three values to agree and a committed adoption receipt to account for the live version, then materializes the canonical state without rewriting history or K00/03. Dry-run by default | `python3 Tools/migrate_standards_state.py . --apply` | +| `standards_state.py` | Shared closed-schema owner for `.cambium/governance/standards_state.yaml`. It parses, validates, snapshots, and deterministically renders one adopter's current Standards/Profile identity; it never falls back to K00/03, writes files, or stores history | imported by governance and runtime consumers; no command-line entry point | | `check_profile.py` | Sole `profile-load` Gate producer 2.0.0. It derives the slot list from `profiles/README.md`; verifies identity/directory agreement, slot bindings, sparse execution overrides, `Configured`/inactive table consistency, invalid UTF-8, sentinels, reserved IDs, and the Structure Registry's closed shape. It then calls `profile_contract.py` once to authorize the machine-active self-path closure from the selected manifest through the Audit Dimension Registry extension dimensions and Judgment Item owner headings and the Registered Scan Registry verifier, optional config, predicate, semantics, and Judgment Item references. Extension Gate rows compile as typed producer, receipt-schema, consumer, owner-field, transition, enum, and pass-authority bindings and must resolve to the installed generic Profile-enum writer capability. Every Profile-owned path must remain lexically and physically inside the selected Profile, exact heading references resolve once, and symlink/hardlink aliases fail closed. A pass summary uses check `profile-check-summary`, Gate ID `profile-load`, dimension `guidance_and_contract`, and binds `selected_profile_manifest`, the complete Profile-tree `profile_snapshot_sha256`, `profile_contract_fingerprint`, and the canonical root-input `profile_load_inputs_sha256`. Receipt output is refused inside the Profile itself so validation cannot mutate the package whose snapshot it binds. The checker parses one immutable Profile-tree snapshot and rechecks both that tree and the canonical inputs before authorization. It checks authority and structure, never answer quality, and is not run against `_template` itself. `--json` writes one deterministic structured-diagnostics object to stdout (tool, root, result, findings), each finding carrying a category from the closed classification map: `mechanical` (an assisting agent can fix it directly and rerun — path resolution, identity/directory agreement, table and manifest shape, self-reference containment, declaration word shape) vs `semantic-unresolved` (an operator answer is missing or unconfirmed — `unfilled-placeholder` sentinels and other open decisions); human output, receipts, and exit codes are unchanged | `python3 Tools/check_profile.py profiles/ --root . --receipts Tools/receipts/profile.jsonl` | | `check_structure.py` | Sole `structure-registry` gate 1.1.0 (K01/05, K01/06): resolves the selected profile's Structure Registry against the vault — unit and support-layer roots, canonical entries and `expected_type` frontmatter, embedded headings, per-mode role declarations, Profile Scope layer membership, module-inside-parent containment, flat/grouped layout consistency with declared class-to-directory agreement, Corpus Planning Global Map entry bindings, and Coverage Ledger `structural_unit` references; `--profile` overrides the active-state selection; fails closed on an unresolved profile, unbound or unreadable registry, or a configured registry with no units. It proves structure declarations, never content quality or class-assignment semantics | `python3 Tools/check_structure.py . --profile profiles/ --receipts Tools/receipts/structure.jsonl` | | `compose_page_contract.py` | Deterministic page-contract compiler 1.2.0 (K08/06): composes the kernel `applicability-base.yaml` and `relationship-base.yaml` with the selected profile's `Metadata Contract` and `Vocabulary Extensions` and the K07 `sources-role-base.yaml` into `Tools/page_contract.yaml`, including the profile-bound section-role display titles; a profile difference may only tighten a kernel mode, extensions must not collide with kernel fields, and `--check` verifies the artifact is byte-current; the K08/09 boundary projection display labels compose as kernel defaults overlaid by the profile's `boundary_projection.labels`; `--profile` names a profile for a validation run without selecting it | `python3 Tools/compose_page_contract.py --profile profiles/` | @@ -139,7 +142,7 @@ Every ordinary runtime writer (`compile_queue`, `update_queue`, `apply_delta`, `register_amendment`, and `apply_amendment`) carries one indivisible authority context from its first successful `check_queue.validate_runtime` call. The context contains the exact authorized Profile snapshot/contract/root-input -view and approved K00/03 byte view. Proposed, locked, post-write, and +view, approved Standards-rule bytes, and canonical adopter-state view. Proposed, locked, post-write, and persisted-state validations inject those same objects instead of rerunning `profile-load`; state and receipt publication CAS-check both views before and after each boundary. The lock owner records their durable fingerprints so a @@ -687,6 +690,11 @@ evidence silently. is admission-only rather than batch-scoped. Its empty after-load lists are placeholders; a real plan supplies the complete derived Read Set/module closure +- `standards_state.template.yaml` -- the closed canonical current-state + document under `.cambium/governance/`: one adopter Standards/Profile + identity, effective date, upstream provenance, state revision, and latest + adoption receipt. It is not a chronological register; history stays in the + append-only Standards-adoption receipt stream - `profile_adoption_plan.template.yaml` -- the closed restricted-YAML plan consumed by `apply_profile_adoption.py`, the no-runtime sibling of the active-task adoption plan above (rule owner: K00/03; R09 both branches). diff --git a/Tools/check_queue.py b/Tools/check_queue.py index 9b0a22f..5082e0f 100644 --- a/Tools/check_queue.py +++ b/Tools/check_queue.py @@ -273,7 +273,14 @@ "planned_after": ("planned_after_progress_sha256",), }, "standards": { - "before": ("before_standards_state_sha256",), + # Ordinary writers do not change adopter Standards state, but their + # frozen runtime-authority context already records the exact active + # bytes. Treat that existing field as the before-image alias so + # interrupted-write recovery does not call a bound authority input + # unavailable. Standards adoption supplies its explicit before/after + # pair and therefore retains the four-state transaction distinction. + "before": ("before_standards_state_sha256", + "active_standards_sha256"), "planned_after": ("planned_after_standards_state_sha256",), }, } diff --git a/Tools/compiled/cli-contract.yaml b/Tools/compiled/cli-contract.yaml index 5abb3dd..b2f85bf 100644 --- a/Tools/compiled/cli-contract.yaml +++ b/Tools/compiled/cli-contract.yaml @@ -66,7 +66,7 @@ source_files: - Tools/stamp_cards.py - Tools/update_queue.py - Tools/update_task.py -source_hash: sha256:f7a5a074561a1740ba5e08dd717c82558da549743c9f2aa5ccfd689120c7cc2c +source_hash: sha256:443790228b15aa418befe790527ba7f1d625e7729b5d9b672a562f0666ede300 receipt_shape: base_fields: - receipt_id @@ -1752,7 +1752,7 @@ tools: receipt_extensions_extraction: partial - tool: check_queue module: Tools/check_queue.py - source_hash: sha256:5e0db75e6b6d7b209b7764092e3c54f71d02560357d38d5b77118f772c1cc07d + source_hash: sha256:5eff5f82b39e03669c346931c6b42236d7eb7acfe9d711e327e895bcf78b32a1 description: Validate canonical Required Queue state arguments: - dest: root diff --git a/Tools/compiled/host-configs/claude-code.mcp.json b/Tools/compiled/host-configs/claude-code.mcp.json index 6a436d2..4538d8d 100644 --- a/Tools/compiled/host-configs/claude-code.mcp.json +++ b/Tools/compiled/host-configs/claude-code.mcp.json @@ -1 +1 @@ -{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79","CAMBIUM_WORKSPACE_ROOT":""}}}} +{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:6c0f03aa014261e968cf2432ed73f626d87ae7d95de14a38f39f76bb040df59e","CAMBIUM_WORKSPACE_ROOT":""}}}} diff --git a/Tools/compiled/host-configs/codex.config.toml b/Tools/compiled/host-configs/codex.config.toml index 9ea7c93..4ed1d38 100644 --- a/Tools/compiled/host-configs/codex.config.toml +++ b/Tools/compiled/host-configs/codex.config.toml @@ -5,7 +5,7 @@ # server name: cambium # server entry point: Tools/mcp_server.py (under the distribution root) # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79 +# source_hash: sha256:6c0f03aa014261e968cf2432ed73f626d87ae7d95de14a38f39f76bb040df59e # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # @@ -35,5 +35,5 @@ command = "python3" cwd = "" [mcp_servers.cambium.env] -CAMBIUM_INTERFACE_SOURCE_HASH = "sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79" +CAMBIUM_INTERFACE_SOURCE_HASH = "sha256:6c0f03aa014261e968cf2432ed73f626d87ae7d95de14a38f39f76bb040df59e" CAMBIUM_WORKSPACE_ROOT = "" diff --git a/Tools/compiled/host-configs/dsh-profile-patch.yaml b/Tools/compiled/host-configs/dsh-profile-patch.yaml index b0aee84..00d0683 100644 --- a/Tools/compiled/host-configs/dsh-profile-patch.yaml +++ b/Tools/compiled/host-configs/dsh-profile-patch.yaml @@ -5,7 +5,7 @@ # server name: cambium # server entry point: Tools/mcp_server.py (under the distribution root) # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79 +# source_hash: sha256:6c0f03aa014261e968cf2432ed73f626d87ae7d95de14a38f39f76bb040df59e # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # diff --git a/Tools/compiled/host-configs/dsh.env b/Tools/compiled/host-configs/dsh.env index 935e9eb..5168d47 100644 --- a/Tools/compiled/host-configs/dsh.env +++ b/Tools/compiled/host-configs/dsh.env @@ -4,7 +4,7 @@ # carries: binding # server name: cambium # source: Tools/compiled/mcp-tools.json -# source_hash: sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79 +# source_hash: sha256:6c0f03aa014261e968cf2432ed73f626d87ae7d95de14a38f39f76bb040df59e # regenerate: python3 Tools/render_host_configs.py . # verify: python3 Tools/render_host_configs.py . --check # @@ -21,5 +21,5 @@ # valid absolute path on any of these hosts, so an un-substituted copy # fails at launch instead of resolving to something. -CAMBIUM_INTERFACE_SOURCE_HASH="sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79" +CAMBIUM_INTERFACE_SOURCE_HASH="sha256:6c0f03aa014261e968cf2432ed73f626d87ae7d95de14a38f39f76bb040df59e" CAMBIUM_WORKSPACE_ROOT="" diff --git a/Tools/compiled/host-configs/kimi-code.mcp.json b/Tools/compiled/host-configs/kimi-code.mcp.json index 6a436d2..4538d8d 100644 --- a/Tools/compiled/host-configs/kimi-code.mcp.json +++ b/Tools/compiled/host-configs/kimi-code.mcp.json @@ -1 +1 @@ -{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:2a8632476bf39419cd441cde6de13d7300af40a1fdda867b1784292de1ddda79","CAMBIUM_WORKSPACE_ROOT":""}}}} +{"mcpServers":{"cambium":{"args":["/Tools/mcp_server.py"],"command":"python3","cwd":"","env":{"CAMBIUM_INTERFACE_SOURCE_HASH":"sha256:6c0f03aa014261e968cf2432ed73f626d87ae7d95de14a38f39f76bb040df59e","CAMBIUM_WORKSPACE_ROOT":""}}}} diff --git a/Tools/compiled/mcp-tools.json b/Tools/compiled/mcp-tools.json index e422007..3523711 100644 --- a/Tools/compiled/mcp-tools.json +++ b/Tools/compiled/mcp-tools.json @@ -1 +1 @@ -{"artifact":"agent-interface-projection","form":"mcp","generated":{"not_a_revision_basis":"This file is downstream of each tool's own argparse declaration and is never the basis for revising one. To change what an agent may call, change the tool's argparse block, recompile Tools/compiled/cli-contract.yaml, then regenerate this file.","notice":"Generated artifact -- do not edit. Every value here is projected from Tools/compiled/cli-contract.yaml by Tools/render_interface_projection.py; a hand edit is reported by --check as a HOLD.","regenerate":"python3 Tools/render_interface_projection.py .","verify":"python3 Tools/render_interface_projection.py . --check"},"generator":"Tools/render_interface_projection.py","generator_version":"1.0.0","schema_version":1,"source":"Tools/compiled/cli-contract.yaml","source_artifact":"cli-invocation-contract","source_hash":"sha256:2acd612e70e4abe5103aa7d081ad60a87f1e5a857cb46aecaaadce12125fc86b","source_manifest_hash":"sha256:f7a5a074561a1740ba5e08dd717c82558da549743c9f2aa5ccfd689120c7cc2c","source_schema_version":1,"tool_count":46,"tools":[{"description":"Adopt one approved Standards/Profile revision","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Standards adoption","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/standards-adoptions/*.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/standards-adoptions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"adopt_standards"},{"description":"Apply one approved cross-Ledger Amendment transaction","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply an Amendment transaction","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"apply_amendment"},{"description":"Amend the frozen Task Contract from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a contract amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/contract-amendments","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/contract-amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_contract_amendment"},{"description":"Deterministic Coverage Delta application","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply canonical Coverage","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the merged Coverage; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"delta":{"description":"batch Coverage delta to apply; canonical mode requires exactly .cambium/deltas/.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"expected_coverage_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Coverage; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"force":{"default":false,"description":"legacy mode only: keep pages whose ledger batch/next_batch does not match the delta batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--force"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage ledger to merge into; canonical mode requires exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"preflight":{"default":false,"description":"plan canonical Coverage and routed-gap settlement without writes; allows an open batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--preflight"]}},"receipts":{"description":"receipt JSONL destination; canonical mode defaults to a new .cambium/receipts/.jsonl and refuses an existing path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root (canonical mode)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["ledger","delta"],"type":"object"},"name":"apply_delta","x-cambium-mutually-exclusive":[{"dests":["apply","preflight"],"required":false}]},{"description":"Apply one receipt-backed Profile metadata transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"commit owner state and page projection","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"Coverage fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_page_sha256":{"description":"target page fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-page-sha256"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"gate_receipt":{"description":"current producer receipt ID for this Gate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"description":"fresh JSONL path under .cambium/receipts; default is .jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","gate_receipt"],"type":"object"},"name":"apply_metadata_transition"},{"description":"Apply one no-runtime R09 Profile adoption (initial adoption or pre-runtime profile revision) from a restricted-YAML plan","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"perform the transaction; without it the complete planned change is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"root-relative adoption plan (schemas/profile_adoption_plan.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"description":"must be the canonical Standards history stream .cambium/receipts/standards-adoptions.jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"repository root (no task runtime may exist; governance state may exist)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_profile_adoption"},{"description":"Materialize a task runtime from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/task-plans","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/task-plans.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_task_plan"},{"description":"Run and publish the K12/09 batch-close evidence bundle","inputSchema":{"additionalProperties":false,"properties":{"accept_candidate_id":{"default":[],"description":"accept this exact current candidate for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-id"]}},"accept_candidate_type":{"default":[],"description":"accept every current candidate of this exact tool:check type for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-type"]}},"accept_while_unchanged_id":{"default":[],"description":"accept this exact current candidate and permit reuse while its observation is unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-id"]}},"accept_while_unchanged_type":{"default":[],"description":"expand this current exact type set and permit those rows to be reused while unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-type"]}},"batch":{"description":"merge-ready batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"integrator":{"description":"declared integrator label recorded in the evidence","type":"string","x-cambium-cli":{"action":"store","option_strings":["--integrator"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/batch-close.jsonl","description":"repository-relative close evidence JSONL","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"review_attestation":{"description":"reviewer's explicit global-review statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--review-attestation"]}},"reviewer":{"description":"declared reviewer label (must differ from integrator)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","batch","integrator","reviewer","review_attestation"],"type":"object"},"name":"check_batch_close"},{"description":"Validate page boundary blocks against the K08/09 page boundary contract (gate: boundary-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures except the B4 migration-tolerated case; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_boundary_contract"},{"description":"Validate explicit Corpus Planning artifacts","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write only the deterministic normalized result JSON to stdout","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"repository-relative Profile manifest or Profile directory; default: selected Profile in Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"append JSONL receipts here","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_corpus_plan"},{"description":"Closed-world freshness / review_by candidate check","inputSchema":{"additionalProperties":false,"properties":{"as_of":{"description":"reference date YYYY-MM-DD for overdue computation (default: today)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--as-of"]}},"defaults":{"description":"optional domain -> volatility mapping file (restricted YAML subset); an active page with no explicit or defaulted volatility is a candidate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"exclude":{"default":[],"description":"skip files whose path contains this component (repeatable; default: none)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_freshness"},{"description":"Wiki link missing/ambiguous/heading check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); files whose path contains the component are neither scanned for outgoing links nor used in basename disambiguation, but exact full-path links into them still resolve (excluded means not audited, not nonexistent)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (the index still covers the whole vault)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_links"},{"description":"MOC Module Index consistency candidate detection","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); no semantic directory name is excluded by default","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append a machine-readable receipt to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"scan root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_moc"},{"description":"Validate pages against the compiled frontmatter page contract (gate: page-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_page_contract"},{"description":"Profile manifest completeness and unfilled-template check","inputSchema":{"additionalProperties":false,"properties":{"defaults":{"description":"machine-readable profile-form placeholder registry (default: Tools/schemas/execution_defaults.template.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"execution_defaults":{"description":"kernel execution-default override registry (default: kernel/K00 Standards Control/execution-defaults-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--execution-defaults"]}},"interface":{"description":"normative slot interface file (default: profiles/README.md under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--interface"]}},"json":{"default":false,"description":"write one deterministic JSON object (tool, root, result, findings each carrying a closed mechanical/semantic-unresolved category) to stdout instead of the human summary; receipts and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_dir":{"description":"the profile directory to check (e.g. profiles/)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"default":".","description":"vault root that vault-relative bindings resolve against (default: this script's repository root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["profile_dir"],"type":"object"},"name":"check_profile"},{"description":"Terminal Proof completeness and zero-condition check","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage Ledger YAML; with --root this must be exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger"]}},"progress_ledger":{"description":"Progress Ledger YAML; required with --root and must be exactly .cambium/state/progress_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--progress-ledger"]}},"proof":{"description":"path to the terminal proof YAML file","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"vault root; when given, path-valued proof fields must exist and selected routes, Cards, and kernel Read Sets must agree with the canonical route indexes","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"template":{"default":"Tools/schemas/terminal_proof.template.yaml","description":"field-list template (default Tools/schemas/terminal_proof.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--template"]}}},"required":["proof"],"type":"object"},"name":"check_proof"},{"description":"Validate canonical Required Queue state","inputSchema":{"additionalProperties":false,"properties":{"boundary_gate_receipt":{"default":[],"description":"current gate evidence supplied to --require-revalidation","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--boundary-gate-receipt"]}},"budget_manifest_receipt":{"description":"closed budget-manifest receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--budget-manifest-receipt"]}},"confirmation_receipt":{"description":"confirmation evidence supplied to --require-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"deliver_readback":{"description":"deliver one registered conditional Card read-back source for an already-open batch","type":"string","x-cambium-cli":{"action":"store","option_strings":["--deliver-readback"]}},"json":{"default":false,"description":"write this run's receipt object to stdout as one canonical JSON array and move the human report to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger_advance_receipt":{"description":"Coverage Ledger advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger-advance-receipt"]}},"readback_rule":{"description":"registered rule selected with --deliver-readback","type":"string","x-cambium-cli":{"action":"store","option_strings":["--readback-rule"]}},"receipts":{"description":"repository-relative JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"require_complete":{"default":false,"description":"build completion gate: prove no Required work remains","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-complete"]}},"require_maintenance_complete":{"default":false,"description":"maintenance completion gate: prove one bounded maintenance run is complete","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-maintenance-complete"]}},"require_ready":{"description":"prove BATCH_ID is queued and ready to activate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-ready"]}},"require_revalidation":{"description":"prove BATCH_ID may produce its Standards revalidation aggregate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-revalidation"]}},"resume_status":{"default":false,"description":"show interruption-safe task and batch resume state","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--resume-status"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"watermark_advance_receipt":{"description":"watermark advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--watermark-advance-receipt"]}}},"required":["root"],"type":"object"},"name":"check_queue","x-cambium-mutually-exclusive":[{"dests":["require_ready","require_revalidation","require_complete","require_maintenance_complete","resume_status","deliver_readback"],"required":false}]},{"description":"Find profile-configured residual content outside accepted roots.","inputSchema":{"additionalProperties":false,"properties":{"config":{"description":"profile-owned restricted YAML scan configuration","type":"string","x-cambium-cli":{"action":"store","option_strings":["--config"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"positive_controls_only":{"default":false,"description":"execute the registered controls through the production classifier without scanning repository content","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--positive-controls-only"]}},"receipts":{"description":"optional JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scan_id":{"description":"stable ID from the selected profile's scan registry","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scan-id"]}},"time_limit":{"default":55.0,"description":"hard evidence-production budget in seconds (greater than 0 and at most 55)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--time-limit"],"type":"float"}},"vault_root":{"description":"knowledge-vault root to scan","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root","scan_id","config"],"type":"object"},"name":"check_residual_content"},{"description":"Validate the selected profile's Structure Registry against the vault (gate: structure-registry).","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_structure"},{"description":"Frontmatter controlled-vocabulary check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"subpath to exclude (repeatable; e.g. the compiled kernel/Cards artifacts, whose frontmatter is not governed by the K08 module's knowledge-page schema)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"policy_fingerprint":{"description":"effective-policy fingerprint (kblib.effective_priority_policy) the quotas were resolved from; recorded on the priority-quota-compliance receipt so its consumers can bind the policy identity, never re-derive it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--policy-fingerprint"]}},"quota_p0":{"default":15.0,"description":"P0 priority quota in percent (default 15; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p0"],"type":"float"}},"quota_p1":{"default":35.0,"description":"P1 priority quota in percent (default 35; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p1"],"type":"float"}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"vocab":{"description":"path to vocab.yaml (defaults to vocab.yaml next to this script)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--vocab"]}}},"required":["vault_root"],"type":"object"},"name":"check_vocab"},{"description":"Compile the machine-readable CLI invocation contract from every Tools/*.py argparse declaration.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 when it is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"artifact path to write or verify (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root whose Tools/ directory is compiled","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_cli_contract"},{"description":"Compile Required Queue from explicit Coverage assignments","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Queue write or replan","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"registered Amendment id authorizing the replan; required with --apply-replan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"materialize an initially empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"apply_replan":{"default":false,"description":"apply a controlled structural diff to a non-empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply-replan"]}},"coverage_proposal":{"description":"repository-contained .cambium/deltas/replans/*.coverage.yaml input","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_revision":{"description":"compare-and-swap guard: the queue_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-revision"],"type":"int"}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the replan is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"output":{"description":"repository-relative proposal path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"receipts":{"default":".cambium/receipts/queue-structure.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"replan_diff":{"description":"existing .cambium/tmp/*.yaml diff to consume","type":"string","x-cambium-cli":{"action":"store","option_strings":["--replan-diff"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_queue","x-cambium-mutually-exclusive":[{"dests":["apply","apply_replan"],"required":false}]},{"description":"Compose the effective frontmatter page contract from the kernel bases and the selected profile's Metadata Contract.","inputSchema":{"additionalProperties":false,"properties":{"base":{"description":"applicability base to compile from (default: kernel/K08 Metadata and Status/applicability-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"compiled page contract to write, or to compare against under --check (default: Tools/page_contract.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"profile":{"description":"profile directory for a validation run; the vault selection stays with K00/03","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"relationships":{"description":"relationship base to compile from (default: kernel/K08 Metadata and Status/relationship-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--relationships"]}},"root":{"default":".","description":"vault root (default: this repository)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"sources_role":{"description":"sources-role base to compile from (default: kernel/K07 Sources and Accuracy/sources-role-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--sources-role"]}}},"type":"object"},"name":"compose_page_contract"},{"description":"Deterministically compose the vocabulary artifact from the kernel base and the selected profile's extensions.","inputSchema":{"additionalProperties":false,"properties":{"base":{"default":"kernel/K08 Metadata and Status/vocabulary-base.yaml","description":"the kernel vocabulary base the extensions are appended to (default: kernel/K08 Metadata and Status/vocabulary-base.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when values and provenance are identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"extensions":{"description":"the active profile's vocabulary-extensions.yaml. Canonical adopter Standards state selects the path; when this flag is present it must name that same path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--extensions"]}},"output":{"default":"Tools/vocab.yaml","description":"composed vocabulary artifact to write, or to compare against under --check (default: Tools/vocab.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}}},"type":"object"},"name":"compose_vocab"},{"description":"Cross-file duplicate paragraph candidate detection (for maintenance runs and governance tasks)","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"description":"skip files whose path contains this component (repeatable; default: legacy)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to (shared convention, Tools/schemas/receipt.template.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"subpath (relative to vault, or absolute): only report similar pairs with at least one side under it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault":{"default":".","description":"vault root directory (default: current directory)","type":"string","x-cambium-cli":{"action":"store","nargs":"?","option_strings":[]}}},"type":"object"},"name":"duplicate_check"},{"description":"Initialize empty Cambium runtime state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"materialize .cambium/; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"initial Coverage timestamp (default: current UTC)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"completion_semantics":{"description":"build requires completion-candidate plus Terminal Proof; maintenance closes directly through the bounded maintenance completion gate","enum":["build","maintenance"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--completion-semantics"]}},"concurrency_cap":{"description":"explicit task-contract override of K13/10's concurrency cap; omit it to take the selected profile manifest's registered override, or the kernel default 3 when the manifest registers none","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--concurrency-cap"],"type":"int"}},"contract_version":{"default":"c1","description":"non-empty task-contract version recorded on the Progress Ledger contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract-version"]}},"exclusions":{"default":[],"description":"explicit out-of-scope item; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"objective":{"description":"non-empty statement of the task outcome","type":"string","x-cambium-cli":{"action":"store","option_strings":["--objective"]}},"profile_manifest":{"description":"repository-relative selected profile manifest; must equal the selected_profile_manifest of the canonical adopter Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-manifest"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"scope_version":{"description":"non-empty scope identity stamped on the Queue, Coverage Ledger and task contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope-version"]}},"standards_version":{"description":"Standards version this runtime adopts; must equal the approved standards_version of the canonical adopter Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-version"]}},"task_id":{"description":"non-empty task identity stamped on the Queue, Coverage Ledger and Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--task-id"]}}},"required":["root","task_id","objective","scope_version","standards_version","profile_manifest","completion_semantics"],"type":"object"},"name":"init_state"},{"description":"Compile and load Cambium's closed metadata-execution authority contract. This module is deliberately the single authority boundary between metadata declarations and executable writers. A field rule is executable only when an installed writer capability declares the same ``(field, transition, adapter)`` operation, and every installed writer operation must be authorized by exactly one rule. Unknown keys, unknown adapters, orphan implementations, and partial evidence bindings fail closed.","inputSchema":{"additionalProperties":false,"properties":{"authority":{"default":"kernel/K08 Metadata and Status/metadata-authority-base.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--authority"]}},"capabilities":{"default":"Tools/operation-capabilities.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--capabilities"]}},"check":{"default":false,"type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":"Tools/compiled/metadata-execution-contract.json","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"default":".","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"type":"object"},"name":"metadata_execution_contract"},{"description":"Migrate existing runtime identity to Standards state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write state; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"migrate_standards_state"},{"description":"Read-only onboarding status projector: derives the adoption/onboarding state of one root and exactly one next_action token; writes nothing and owns no ledger","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"emit the status view as one deterministic JSON object instead of the human summary","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"target one candidate profile directory name under profiles/ for the full profile-load evaluation (defaults to the single candidate when exactly one exists)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"the adopting repository root to project","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"profile_onboarding_status"},{"description":"Project metadata-contract owner state onto page frontmatter","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"take the runtime writer lock and publish the projection; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"page":{"description":"limit to these repository-relative pages (repeatable); default is every Ledger page","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--page"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"project_page_state"},{"description":"Record one snapshot-bound Batch Review judgment","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"batch":{"description":"exact open Queue batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"judgment_item":{"description":"registered Batch Review Requirement Judgment Item ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--judgment-item"]}},"receipts":{"default":".cambium/receipts/batch-judgments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reviewer_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer-role"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded judgment statement (the concrete verdict, not \"reviewed\")","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"target":{"description":"manifest page path, or the batch ID for a batch-selector requirement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--target"]}}},"required":["root","batch","judgment_item","target","reviewer_role","statement"],"type":"object"},"name":"record_batch_judgment"},{"description":"Record a Profile-authorized Corpus Planning semantic decision as machine-readable JSONL","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared authority Role ID; required with --apply and must equal the Profile/plan binding","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the structural and semantic receipts; default is dry-run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"plan":{"description":"closed restricted-YAML acceptance decision plan; one .yaml file directly under .cambium/deltas/corpus-plan-acceptances/","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/corpus-plan-acceptance.jsonl","description":"repository-relative JSONL path the receipts are appended to (default: .cambium/receipts/corpus-plan-acceptance.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"record_corpus_acceptance"},{"description":"Record snapshot-bound manual Extension Gate evidence","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-attestations.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded manual attestation statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","actor_role","statement"],"type":"object"},"name":"record_gate_attestation"},{"description":"Run a registered scan and record a deterministic Extension Gate result","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"run and append the bound Gate result","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact deterministic typed Profile Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-results.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","gate_id","page"],"type":"object"},"name":"record_gate_result"},{"description":"Register one approved current-protocol Amendment","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may register or withdraw an Amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"id for a queue-replan registration; cross-Ledger operations derive it from --plan instead","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"write the registration; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"approval_reference":{"description":"explicit-user approval reference; required when --decision-mode is explicit-user","type":"string","x-cambium-cli":{"action":"store","option_strings":["--approval-reference"]}},"coverage_proposal":{"description":".cambium/deltas/replans/*.coverage.yaml proposal","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"date":{"description":"YYYY-MM-DD; must equal the UTC registration date","type":"string","x-cambium-cli":{"action":"store","option_strings":["--date"]}},"decision_mode":{"default":"auto","description":"derive delegated authority by default; explicit-user requires --approval-reference","enum":["auto","contract-delegated","explicit-user"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--decision-mode"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the published receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"operation":{"description":"Amendment operation being registered","enum":["cancel-batch","gap-routing-reconciliation","property-state-migration","queue-replan","scope-replan"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--operation"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"reason":{"description":"nonempty withdrawal reason recorded on the row and its receipt","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"summary":{"description":"non-empty one-line rationale recorded on the row","type":"string","x-cambium-cli":{"action":"store","option_strings":["--summary"]}},"withdraw":{"description":"retire the named pending registration instead of registering one (K13/06 withdrawal); requires --reason","type":"string","x-cambium-cli":{"action":"store","option_strings":["--withdraw"]}}},"required":["root","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"register_amendment"},{"description":"Render the K08/09 boundary projection blocks from page `boundary` frontmatter.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_boundary_projection"},{"description":"Render the Cambium MCP server's registration and corpus binding into the configuration file each supported host reads.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"re-render and compare against the existing products; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"distribution_root":{"description":"absolute path of the Cambium checkout the server is launched from; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--distribution-root"]}},"host":{"description":"render only this host's product (default: every host)","enum":["claude-code","codex","dsh-env","dsh-profile-patch","kimi-code"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--host"]}},"output_dir":{"description":"directory to write or verify the products in (default: /Tools/compiled/host-configs)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output-dir"]}},"projection":{"description":"compiled interface projection to bind to (default: /Tools/compiled/mcp-tools.json)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--projection"]}},"root":{"description":"repository root holding the compiled interface projection","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every rendered field and exit without reading or writing any product","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}},"workspace_root":{"description":"absolute path of the corpus repository this registration is bound to; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--workspace-root"]}}},"required":["root"],"type":"object"},"name":"render_host_configs","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Project the compiled CLI invocation contract into the agent-facing interface forms registered in this tool.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing artifacts; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"description":"compiled CLI contract to project (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"form":{"description":"project only this form (default: every registered form)","enum":["mcp"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--form"]}},"output":{"description":"artifact path to write or verify; requires --form, because one path cannot hold two forms","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root holding the compiled CLI contract","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every projected field and exit without reading or writing any artifact","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}}},"required":["root"],"type":"object"},"name":"render_interface_projection","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Render Required Queue human report","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"compare existing report instead of writing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":".cambium/reports/required_queue.md","description":"repository-relative report path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"stdout":{"default":false,"description":"print the report to stdout and write nothing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--stdout"]}}},"required":["root"],"type":"object"},"name":"render_queue"},{"description":"Render derived Structure Registry coverage projections (K01/05 derived roles).","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale or missing; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_structure_projection"},{"description":"Run the adopter verification set derived from the K00/12 Stable Gate ID Registry (deterministic, not-batch-scoped producers).","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path prefix passed through to scanners that accept it (repeatable)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"list":{"default":false,"description":"print the derived set and each command without running anything","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--list"]}},"profile":{"description":"profile directory override; default is the live runtime's selected_profile_manifest","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"run_gates"},{"description":"Scaffold a candidate profile from profiles/_template using the exact-copy whitelist in profiles/template-files.yaml","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"create the candidate; without it the plan is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"candidate profile slug matching [a-z0-9][a-z0-9_-]* (equals the directory name)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"repository root containing profiles/","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","profile_id"],"type":"object"},"name":"scaffold_profile"},{"description":"Seal verified frozen receipt history (K12/07). --apply is a maintenance-window operation: run it only with no other Cambium or adopter writer, checker or receipt appender active against this repository.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the seal, or with --reconcile finish the interrupted one; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/seal-receipts.jsonl","description":"repository-relative JSONL path for this tool's own seal receipts, which never seal (default: .cambium/receipts/seal-receipts.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reconcile":{"default":false,"description":"finish an interrupted seal over the publication paths this tool implements; other interruptions fail closed and are resolved by the runbook in Tools/README.md","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--reconcile"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"verify":{"default":false,"description":"re-prove every sealed segment, projection and seal-receipt binding, then exit","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--verify"]}}},"required":["root"],"type":"object"},"name":"seal_receipts"},{"description":"Stamp kernel Runtime Cards","inputSchema":{"additionalProperties":false,"properties":{"acknowledge_compiled":{"default":false,"description":"after semantic regeneration/review, advance compiled_source_hash to the exact current source digest","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--acknowledge-compiled"]}},"cards_dir":{"default":"kernel/Cards","description":"Card directory relative to (default: kernel/Cards)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--cards-dir"]}},"check":{"default":false,"description":"verify only; never write","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"set_version":{"description":"also set every card's compiled_from value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--set-version"]}}},"required":["root"],"type":"object"},"name":"stamp_cards"},{"description":"Apply one Required Queue transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; Queue transition planning and apply both require integrator","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"batch_receipt":{"default":[],"description":"batch-review gate receipt id for open -> merge-ready; exactly one is accepted","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--batch-receipt"]}},"close_gate_receipt":{"description":"check_batch_close receipt id required by the closed transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--close-gate-receipt"]}},"confirmation_receipt":{"description":"confirmation receipt id required by queued -> open when the batch is confirmation_required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"delta_apply_receipt":{"description":"apply_delta receipt id required by the closed transition and by merge-ready -> open reopen","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-apply-receipt"]}},"delta_path":{"description":"repository-relative .cambium/deltas/.yaml batch delta required by open -> merge-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-path"]}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"gate_receipt":{"description":"gate receipt id: activation gate for queued -> open, Queue consistency gate for closed and for clearing revalidation-required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"hold_state":{"description":"target hold state; exclusive with --transition","enum":["blocked","confirmation-required","none","paused","revalidation-required"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--hold-state"]}},"id":{"description":"Required Queue batch id to transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--id"]}},"json":{"default":false,"description":"write the applied transition receipt(s) to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"reason":{"description":"non-empty rationale required by merge-ready -> open and by any non-none hold","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/queue-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"standards_revalidation_receipt":{"description":"check_queue --require-revalidation receipt discharging an outstanding Standards revalidation; queued -> open or revalidation-required -> none only","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-revalidation-receipt"]}},"transition":{"description":"target lifecycle state; exclusive with --hold-state","enum":["closed","merge-ready","open"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","id"],"type":"object"},"name":"update_queue","x-cambium-mutually-exclusive":[{"dests":["transition","hold_state"],"required":true}]},{"description":"Apply one canonical task-state transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a task-state write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"checkpoint_summary":{"description":"non-empty reason required by paused, blocked and cancelled, and when leaving completion-candidate for anything but complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--checkpoint-summary"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the applied transition receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"maintenance_completion_receipt":{"description":"maintenance completion gate receipt id required by complete under maintenance completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--maintenance-completion-receipt"]}},"queue_check_receipt":{"description":"Queue completion gate receipt id required by the completion-candidate transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--queue-check-receipt"]}},"receipts":{"default":".cambium/receipts/task-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"terminal_proof_receipt":{"description":"Terminal Proof receipt id required by complete under build completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--terminal-proof-receipt"]}},"transition":{"description":"target task state in the Progress Ledger","enum":["active","blocked","cancelled","complete","completion-candidate","paused"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","transition"],"type":"object"},"name":"update_task"}],"transports":["stdio","streamable-http"]} +{"artifact":"agent-interface-projection","form":"mcp","generated":{"not_a_revision_basis":"This file is downstream of each tool's own argparse declaration and is never the basis for revising one. To change what an agent may call, change the tool's argparse block, recompile Tools/compiled/cli-contract.yaml, then regenerate this file.","notice":"Generated artifact -- do not edit. Every value here is projected from Tools/compiled/cli-contract.yaml by Tools/render_interface_projection.py; a hand edit is reported by --check as a HOLD.","regenerate":"python3 Tools/render_interface_projection.py .","verify":"python3 Tools/render_interface_projection.py . --check"},"generator":"Tools/render_interface_projection.py","generator_version":"1.0.0","schema_version":1,"source":"Tools/compiled/cli-contract.yaml","source_artifact":"cli-invocation-contract","source_hash":"sha256:a2bf866c62457848c2aa5c7940ccc7d0e912f1e309ca0eb8e1c81c4500b32212","source_manifest_hash":"sha256:443790228b15aa418befe790527ba7f1d625e7729b5d9b672a562f0666ede300","source_schema_version":1,"tool_count":46,"tools":[{"description":"Adopt one approved Standards/Profile revision","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Standards adoption","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/standards-adoptions/*.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/standards-adoptions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"adopt_standards"},{"description":"Apply one approved cross-Ledger Amendment transaction","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply an Amendment transaction","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; planning is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"apply_amendment"},{"description":"Amend the frozen Task Contract from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a contract amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/contract-amendments","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/contract-amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_contract_amendment"},{"description":"Deterministic Coverage Delta application","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply canonical Coverage","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the merged Coverage; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"delta":{"description":"batch Coverage delta to apply; canonical mode requires exactly .cambium/deltas/.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"expected_coverage_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Coverage; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard for canonical --apply: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"force":{"default":false,"description":"legacy mode only: keep pages whose ledger batch/next_batch does not match the delta batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--force"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage ledger to merge into; canonical mode requires exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"preflight":{"default":false,"description":"plan canonical Coverage and routed-gap settlement without writes; allows an open batch","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--preflight"]}},"receipts":{"description":"receipt JSONL destination; canonical mode defaults to a new .cambium/receipts/.jsonl and refuses an existing path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root (canonical mode)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["ledger","delta"],"type":"object"},"name":"apply_delta","x-cambium-mutually-exclusive":[{"dests":["apply","preflight"],"required":false}]},{"description":"Apply one receipt-backed Profile metadata transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"commit owner state and page projection","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"expected_coverage_sha256":{"description":"Coverage fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_page_sha256":{"description":"target page fingerprint observed by the caller","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-page-sha256"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"gate_receipt":{"description":"current producer receipt ID for this Gate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"description":"fresh JSONL path under .cambium/receipts; default is .jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","gate_receipt"],"type":"object"},"name":"apply_metadata_transition"},{"description":"Apply one no-runtime R09 Profile adoption (initial adoption or pre-runtime profile revision) from a restricted-YAML plan","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"perform the transaction; without it the complete planned change is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"root-relative adoption plan (schemas/profile_adoption_plan.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"description":"must be the canonical Standards history stream .cambium/receipts/standards-adoptions.jsonl","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"repository root (no task runtime may exist; governance state may exist)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_profile_adoption"},{"description":"Materialize a task runtime from one confirmed plan.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the transaction; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"plan":{"description":"repository-relative path under .cambium/deltas/task-plans","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/task-plans.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"apply_task_plan"},{"description":"Run and publish the K12/09 batch-close evidence bundle","inputSchema":{"additionalProperties":false,"properties":{"accept_candidate_id":{"default":[],"description":"accept this exact current candidate for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-id"]}},"accept_candidate_type":{"default":[],"description":"accept every current candidate of this exact tool:check type for this close only","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-candidate-type"]}},"accept_while_unchanged_id":{"default":[],"description":"accept this exact current candidate and permit reuse while its observation is unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-id"]}},"accept_while_unchanged_type":{"default":[],"description":"expand this current exact type set and permit those rows to be reused while unchanged","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--accept-while-unchanged-type"]}},"batch":{"description":"merge-ready batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"integrator":{"description":"declared integrator label recorded in the evidence","type":"string","x-cambium-cli":{"action":"store","option_strings":["--integrator"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/batch-close.jsonl","description":"repository-relative close evidence JSONL","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"review_attestation":{"description":"reviewer's explicit global-review statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--review-attestation"]}},"reviewer":{"description":"declared reviewer label (must differ from integrator)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","batch","integrator","reviewer","review_attestation"],"type":"object"},"name":"check_batch_close"},{"description":"Validate page boundary blocks against the K08/09 page boundary contract (gate: boundary-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures except the B4 migration-tolerated case; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_boundary_contract"},{"description":"Validate explicit Corpus Planning artifacts","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write only the deterministic normalized result JSON to stdout","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"repository-relative Profile manifest or Profile directory; default: selected Profile in Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"append JSONL receipts here","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_corpus_plan"},{"description":"Closed-world freshness / review_by candidate check","inputSchema":{"additionalProperties":false,"properties":{"as_of":{"description":"reference date YYYY-MM-DD for overdue computation (default: today)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--as-of"]}},"defaults":{"description":"optional domain -> volatility mapping file (restricted YAML subset); an active page with no explicit or defaulted volatility is a candidate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"exclude":{"default":[],"description":"skip files whose path contains this component (repeatable; default: none)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_freshness"},{"description":"Wiki link missing/ambiguous/heading check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); files whose path contains the component are neither scanned for outgoing links nor used in basename disambiguation, but exact full-path links into them still resolve (excluded means not audited, not nonexistent)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (the index still covers the whole vault)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_links"},{"description":"MOC Module Index consistency candidate detection","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path component to exclude (repeatable); no semantic directory name is excluded by default","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append a machine-readable receipt to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"scan root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"check_moc"},{"description":"Validate pages against the compiled frontmatter page contract (gate: page-contract; advisory by default).","inputSchema":{"additionalProperties":false,"properties":{"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"exclude":{"default":[],"description":"subpath to exclude; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath (directory or single page)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"strict":{"default":false,"description":"treat violations as failures; the mode a governance decision promotes to a gate","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--strict"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_page_contract"},{"description":"Profile manifest completeness and unfilled-template check","inputSchema":{"additionalProperties":false,"properties":{"defaults":{"description":"machine-readable profile-form placeholder registry (default: Tools/schemas/execution_defaults.template.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--defaults"]}},"execution_defaults":{"description":"kernel execution-default override registry (default: kernel/K00 Standards Control/execution-defaults-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--execution-defaults"]}},"interface":{"description":"normative slot interface file (default: profiles/README.md under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--interface"]}},"json":{"default":false,"description":"write one deterministic JSON object (tool, root, result, findings each carrying a closed mechanical/semantic-unresolved category) to stdout instead of the human summary; receipts and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_dir":{"description":"the profile directory to check (e.g. profiles/)","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"default":".","description":"vault root that vault-relative bindings resolve against (default: this script's repository root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"required":["profile_dir"],"type":"object"},"name":"check_profile"},{"description":"Terminal Proof completeness and zero-condition check","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger":{"description":"Coverage Ledger YAML; with --root this must be exactly .cambium/state/coverage_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger"]}},"progress_ledger":{"description":"Progress Ledger YAML; required with --root and must be exactly .cambium/state/progress_ledger.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--progress-ledger"]}},"proof":{"description":"path to the terminal proof YAML file","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"vault root; when given, path-valued proof fields must exist and selected routes, Cards, and kernel Read Sets must agree with the canonical route indexes","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"template":{"default":"Tools/schemas/terminal_proof.template.yaml","description":"field-list template (default Tools/schemas/terminal_proof.template.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--template"]}}},"required":["proof"],"type":"object"},"name":"check_proof"},{"description":"Validate canonical Required Queue state","inputSchema":{"additionalProperties":false,"properties":{"boundary_gate_receipt":{"default":[],"description":"current gate evidence supplied to --require-revalidation","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--boundary-gate-receipt"]}},"budget_manifest_receipt":{"description":"closed budget-manifest receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--budget-manifest-receipt"]}},"confirmation_receipt":{"description":"confirmation evidence supplied to --require-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"deliver_readback":{"description":"deliver one registered conditional Card read-back source for an already-open batch","type":"string","x-cambium-cli":{"action":"store","option_strings":["--deliver-readback"]}},"json":{"default":false,"description":"write this run's receipt object to stdout as one canonical JSON array and move the human report to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"ledger_advance_receipt":{"description":"Coverage Ledger advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--ledger-advance-receipt"]}},"readback_rule":{"description":"registered rule selected with --deliver-readback","type":"string","x-cambium-cli":{"action":"store","option_strings":["--readback-rule"]}},"receipts":{"description":"repository-relative JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"require_complete":{"default":false,"description":"build completion gate: prove no Required work remains","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-complete"]}},"require_maintenance_complete":{"default":false,"description":"maintenance completion gate: prove one bounded maintenance run is complete","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--require-maintenance-complete"]}},"require_ready":{"description":"prove BATCH_ID is queued and ready to activate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-ready"]}},"require_revalidation":{"description":"prove BATCH_ID may produce its Standards revalidation aggregate","type":"string","x-cambium-cli":{"action":"store","option_strings":["--require-revalidation"]}},"resume_status":{"default":false,"description":"show interruption-safe task and batch resume state","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--resume-status"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"watermark_advance_receipt":{"description":"watermark advance receipt ID supplied to --require-maintenance-complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--watermark-advance-receipt"]}}},"required":["root"],"type":"object"},"name":"check_queue","x-cambium-mutually-exclusive":[{"dests":["require_ready","require_revalidation","require_complete","require_maintenance_complete","resume_status","deliver_readback"],"required":false}]},{"description":"Find profile-configured residual content outside accepted roots.","inputSchema":{"additionalProperties":false,"properties":{"config":{"description":"profile-owned restricted YAML scan configuration","type":"string","x-cambium-cli":{"action":"store","option_strings":["--config"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"positive_controls_only":{"default":false,"description":"execute the registered controls through the production classifier without scanning repository content","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--positive-controls-only"]}},"receipts":{"description":"optional JSONL receipt path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scan_id":{"description":"stable ID from the selected profile's scan registry","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scan-id"]}},"time_limit":{"default":55.0,"description":"hard evidence-production budget in seconds (greater than 0 and at most 55)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--time-limit"],"type":"float"}},"vault_root":{"description":"knowledge-vault root to scan","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root","scan_id","config"],"type":"object"},"name":"check_residual_content"},{"description":"Validate the selected profile's Structure Registry against the vault (gate: structure-registry).","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable summary to stderr; receipts written and the exit code are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"check_structure"},{"description":"Frontmatter controlled-vocabulary check","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"subpath to exclude (repeatable; e.g. the compiled kernel/Cards artifacts, whose frontmatter is not governed by the K08 module's knowledge-page schema)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human summary to stderr; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"policy_fingerprint":{"description":"effective-policy fingerprint (kblib.effective_priority_policy) the quotas were resolved from; recorded on the priority-quota-compliance receipt so its consumers can bind the policy identity, never re-derive it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--policy-fingerprint"]}},"quota_p0":{"default":15.0,"description":"P0 priority quota in percent (default 15; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p0"],"type":"float"}},"quota_p1":{"default":35.0,"description":"P1 priority quota in percent (default 35; kernel default; the selected profile manifest or task contract may override)","type":"number","x-cambium-cli":{"action":"store","option_strings":["--quota-p1"],"type":"float"}},"receipts":{"description":"JSONL path to append machine-readable receipts to","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"vocab":{"description":"path to vocab.yaml (defaults to vocab.yaml next to this script)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--vocab"]}}},"required":["vault_root"],"type":"object"},"name":"check_vocab"},{"description":"Compile the machine-readable CLI invocation contract from every Tools/*.py argparse declaration.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 when it is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"artifact path to write or verify (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root whose Tools/ directory is compiled","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_cli_contract"},{"description":"Compile Required Queue from explicit Coverage assignments","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a Queue write or replan","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"registered Amendment id authorizing the replan; required with --apply-replan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"materialize an initially empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"apply_replan":{"default":false,"description":"apply a controlled structural diff to a non-empty Queue","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply-replan"]}},"coverage_proposal":{"description":"repository-contained .cambium/deltas/replans/*.coverage.yaml input","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; the replan is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_revision":{"description":"compare-and-swap guard: the queue_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-revision"],"type":"int"}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the replan is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"json":{"default":false,"description":"write this run's receipt objects to stdout as one canonical JSON array and move the human-readable report to stderr; receipt writing, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"output":{"description":"repository-relative proposal path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"receipts":{"default":".cambium/receipts/queue-structure.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"replan_diff":{"description":"existing .cambium/tmp/*.yaml diff to consume","type":"string","x-cambium-cli":{"action":"store","option_strings":["--replan-diff"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"compile_queue","x-cambium-mutually-exclusive":[{"dests":["apply","apply_replan"],"required":false}]},{"description":"Compose the effective frontmatter page contract from the kernel bases and the selected profile's Metadata Contract.","inputSchema":{"additionalProperties":false,"properties":{"base":{"description":"applicability base to compile from (default: kernel/K08 Metadata and Status/applicability-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when byte-identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"description":"compiled page contract to write, or to compare against under --check (default: Tools/page_contract.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"profile":{"description":"profile directory for a validation run; the vault selection stays with K00/03","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"relationships":{"description":"relationship base to compile from (default: kernel/K08 Metadata and Status/relationship-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--relationships"]}},"root":{"default":".","description":"vault root (default: this repository)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}},"sources_role":{"description":"sources-role base to compile from (default: kernel/K07 Sources and Accuracy/sources-role-base.yaml under --root)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--sources-role"]}}},"type":"object"},"name":"compose_page_contract"},{"description":"Deterministically compose the vocabulary artifact from the kernel base and the selected profile's extensions.","inputSchema":{"additionalProperties":false,"properties":{"base":{"default":"kernel/K08 Metadata and Status/vocabulary-base.yaml","description":"the kernel vocabulary base the extensions are appended to (default: kernel/K08 Metadata and Status/vocabulary-base.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--base"]}},"check":{"default":false,"description":"recompute and compare against the existing output; exit 0 when values and provenance are identical, 2 otherwise","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"extensions":{"description":"the active profile's vocabulary-extensions.yaml. Canonical adopter Standards state selects the path; when this flag is present it must name that same path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--extensions"]}},"output":{"default":"Tools/vocab.yaml","description":"composed vocabulary artifact to write, or to compare against under --check (default: Tools/vocab.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}}},"type":"object"},"name":"compose_vocab"},{"description":"Cross-file duplicate paragraph candidate detection (for maintenance runs and governance tasks)","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"description":"skip files whose path contains this component (repeatable; default: legacy)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"description":"JSONL path to append machine-readable receipts to (shared convention, Tools/schemas/receipt.template.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"scope":{"description":"subpath (relative to vault, or absolute): only report similar pairs with at least one side under it","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault":{"default":".","description":"vault root directory (default: current directory)","type":"string","x-cambium-cli":{"action":"store","nargs":"?","option_strings":[]}}},"type":"object"},"name":"duplicate_check"},{"description":"Initialize empty Cambium runtime state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"materialize .cambium/; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"initial Coverage timestamp (default: current UTC)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"completion_semantics":{"description":"build requires completion-candidate plus Terminal Proof; maintenance closes directly through the bounded maintenance completion gate","enum":["build","maintenance"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--completion-semantics"]}},"concurrency_cap":{"description":"explicit task-contract override of K13/10's concurrency cap; omit it to take the selected profile manifest's registered override, or the kernel default 3 when the manifest registers none","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--concurrency-cap"],"type":"int"}},"contract_version":{"default":"c1","description":"non-empty task-contract version recorded on the Progress Ledger contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract-version"]}},"exclusions":{"default":[],"description":"explicit out-of-scope item; repeatable","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"objective":{"description":"non-empty statement of the task outcome","type":"string","x-cambium-cli":{"action":"store","option_strings":["--objective"]}},"profile_manifest":{"description":"repository-relative selected profile manifest; must equal the selected_profile_manifest of the canonical adopter Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-manifest"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"scope_version":{"description":"non-empty scope identity stamped on the Queue, Coverage Ledger and task contract","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope-version"]}},"standards_version":{"description":"Standards version this runtime adopts; must equal the approved standards_version of the canonical adopter Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-version"]}},"task_id":{"description":"non-empty task identity stamped on the Queue, Coverage Ledger and Progress Ledger","type":"string","x-cambium-cli":{"action":"store","option_strings":["--task-id"]}}},"required":["root","task_id","objective","scope_version","standards_version","profile_manifest","completion_semantics"],"type":"object"},"name":"init_state"},{"description":"Compile and load Cambium's closed metadata-execution authority contract. This module is deliberately the single authority boundary between metadata declarations and executable writers. A field rule is executable only when an installed writer capability declares the same ``(field, transition, adapter)`` operation, and every installed writer operation must be authorized by exactly one rule. Unknown keys, unknown adapters, orphan implementations, and partial evidence bindings fail closed.","inputSchema":{"additionalProperties":false,"properties":{"authority":{"default":"kernel/K08 Metadata and Status/metadata-authority-base.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--authority"]}},"capabilities":{"default":"Tools/operation-capabilities.yaml","type":"string","x-cambium-cli":{"action":"store","option_strings":["--capabilities"]}},"check":{"default":false,"type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":"Tools/compiled/metadata-execution-contract.json","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"default":".","type":"string","x-cambium-cli":{"action":"store","option_strings":["--root"]}}},"type":"object"},"name":"metadata_execution_contract"},{"description":"Migrate existing runtime identity to Standards state","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write state; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"migrate_standards_state"},{"description":"Read-only onboarding status projector: derives the adoption/onboarding state of one root and exactly one next_action token; writes nothing and owns no ledger","inputSchema":{"additionalProperties":false,"properties":{"json":{"default":false,"description":"emit the status view as one deterministic JSON object instead of the human summary","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"target one candidate profile directory name under profiles/ for the full profile-load evaluation (defaults to the single candidate when exactly one exists)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"the adopting repository root to project","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"profile_onboarding_status"},{"description":"Project metadata-contract owner state onto page frontmatter","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"take the runtime writer lock and publish the projection; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"page":{"description":"limit to these repository-relative pages (repeatable); default is every Ledger page","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--page"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"project_page_state"},{"description":"Record one snapshot-bound Batch Review judgment","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"batch":{"description":"exact open Queue batch ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--batch"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"judgment_item":{"description":"registered Batch Review Requirement Judgment Item ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--judgment-item"]}},"receipts":{"default":".cambium/receipts/batch-judgments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reviewer_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reviewer-role"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded judgment statement (the concrete verdict, not \"reviewed\")","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"target":{"description":"manifest page path, or the batch ID for a batch-selector requirement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--target"]}}},"required":["root","batch","judgment_item","target","reviewer_role","statement"],"type":"object"},"name":"record_batch_judgment"},{"description":"Record a Profile-authorized Corpus Planning semantic decision as machine-readable JSONL","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared authority Role ID; required with --apply and must equal the Profile/plan binding","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the structural and semantic receipts; default is dry-run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"plan":{"description":"closed restricted-YAML acceptance decision plan; one .yaml file directly under .cambium/deltas/corpus-plan-acceptances/","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"receipts":{"default":".cambium/receipts/corpus-plan-acceptance.jsonl","description":"repository-relative JSONL path the receipts are appended to (default: .cambium/receipts/corpus-plan-acceptance.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","plan"],"type":"object"},"name":"record_corpus_acceptance"},{"description":"Record snapshot-bound manual Extension Gate evidence","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"description":"declared pass-authority Profile role ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"append the evidence; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact typed Profile Extension Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-attestations.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"statement":{"description":"bounded manual attestation statement","type":"string","x-cambium-cli":{"action":"store","option_strings":["--statement"]}},"value":{"description":"requested registered completion value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--value"]}}},"required":["root","gate_id","page","value","actor_role","statement"],"type":"object"},"name":"record_gate_attestation"},{"description":"Run a registered scan and record a deterministic Extension Gate result","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"run and append the bound Gate result","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"gate_id":{"description":"exact deterministic typed Profile Gate ID","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-id"]}},"json":{"default":false,"description":"write the applied receipt as one JSON array","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"page":{"description":"repository-relative Markdown target","type":"string","x-cambium-cli":{"action":"store","option_strings":["--page"]}},"receipts":{"default":".cambium/receipts/gate-results.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","gate_id","page"],"type":"object"},"name":"record_gate_result"},{"description":"Register one approved current-protocol Amendment","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may register or withdraw an Amendment","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"amendment_id":{"description":"id for a queue-replan registration; cross-Ledger operations derive it from --plan instead","type":"string","x-cambium-cli":{"action":"store","option_strings":["--amendment-id"]}},"apply":{"default":false,"description":"write the registration; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"approval_reference":{"description":"explicit-user approval reference; required when --decision-mode is explicit-user","type":"string","x-cambium-cli":{"action":"store","option_strings":["--approval-reference"]}},"coverage_proposal":{"description":".cambium/deltas/replans/*.coverage.yaml proposal","type":"string","x-cambium-cli":{"action":"store","option_strings":["--coverage-proposal"]}},"date":{"description":"YYYY-MM-DD; must equal the UTC registration date","type":"string","x-cambium-cli":{"action":"store","option_strings":["--date"]}},"decision_mode":{"default":"auto","description":"derive delegated authority by default; explicit-user requires --approval-reference","enum":["auto","contract-delegated","explicit-user"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--decision-mode"]}},"expected_coverage_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Coverage; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-coverage-sha256"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; registration is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the published receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"operation":{"description":"Amendment operation being registered","enum":["cancel-batch","gap-routing-reconciliation","property-state-migration","queue-replan","scope-replan"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--operation"]}},"plan":{"description":".cambium/deltas/amendments/*.yaml plan","type":"string","x-cambium-cli":{"action":"store","option_strings":["--plan"]}},"reason":{"description":"nonempty withdrawal reason recorded on the row and its receipt","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/amendments.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"summary":{"description":"non-empty one-line rationale recorded on the row","type":"string","x-cambium-cli":{"action":"store","option_strings":["--summary"]}},"withdraw":{"description":"retire the named pending registration instead of registering one (K13/06 withdrawal); requires --reason","type":"string","x-cambium-cli":{"action":"store","option_strings":["--withdraw"]}}},"required":["root","expected_coverage_sha256","expected_progress_sha256","expected_queue_sha256"],"type":"object"},"name":"register_amendment"},{"description":"Render the K08/09 boundary projection blocks from page `boundary` frontmatter.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"default":"Tools/page_contract.yaml","description":"compiled contract path (default Tools/page_contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"scope":{"description":"only scan .md files under this subpath","type":"string","x-cambium-cli":{"action":"store","option_strings":["--scope"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_boundary_projection"},{"description":"Render the Cambium MCP server's registration and corpus binding into the configuration file each supported host reads.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"re-render and compare against the existing products; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"distribution_root":{"description":"absolute path of the Cambium checkout the server is launched from; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--distribution-root"]}},"host":{"description":"render only this host's product (default: every host)","enum":["claude-code","codex","dsh-env","dsh-profile-patch","kimi-code"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--host"]}},"output_dir":{"description":"directory to write or verify the products in (default: /Tools/compiled/host-configs)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output-dir"]}},"projection":{"description":"compiled interface projection to bind to (default: /Tools/compiled/mcp-tools.json)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--projection"]}},"root":{"description":"repository root holding the compiled interface projection","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every rendered field and exit without reading or writing any product","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}},"workspace_root":{"description":"absolute path of the corpus repository this registration is bound to; substituted for (default: leave the placeholder)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--workspace-root"]}}},"required":["root"],"type":"object"},"name":"render_host_configs","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Project the compiled CLI invocation contract into the agent-facing interface forms registered in this tool.","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"recompute and compare against the existing artifacts; exit 0 when byte-identical, 2 when one is stale or hand-edited","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"contract":{"description":"compiled CLI contract to project (default: /Tools/compiled/cli-contract.yaml)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--contract"]}},"form":{"description":"project only this form (default: every registered form)","enum":["mcp"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--form"]}},"output":{"description":"artifact path to write or verify; requires --form, because one path cannot hold two forms","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"repository root holding the compiled CLI contract","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"sources":{"default":false,"description":"print the declaration source of every projected field and exit without reading or writing any artifact","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--sources"]}}},"required":["root"],"type":"object"},"name":"render_interface_projection","x-cambium-mutually-exclusive":[{"dests":["check","sources"],"required":false}]},{"description":"Render Required Queue human report","inputSchema":{"additionalProperties":false,"properties":{"check":{"default":false,"description":"compare existing report instead of writing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"output":{"default":".cambium/reports/required_queue.md","description":"repository-relative report path","type":"string","x-cambium-cli":{"action":"store","option_strings":["--output"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"stdout":{"default":false,"description":"print the report to stdout and write nothing","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--stdout"]}}},"required":["root"],"type":"object"},"name":"render_queue"},{"description":"Render derived Structure Registry coverage projections (K01/05 derived roles).","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"rewrite the stale owned blocks atomically; omit to only report what would render","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"check":{"default":false,"description":"exit 2 when any owned block is stale or missing; the default report never fails on staleness","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"profile":{"description":"profile directory override; default is the selected_profile_manifest of the active Standards state","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"vault_root":{"description":"vault root directory","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["vault_root"],"type":"object"},"name":"render_structure_projection"},{"description":"Run the adopter verification set derived from the K00/12 Stable Gate ID Registry (deterministic, not-batch-scoped producers).","inputSchema":{"additionalProperties":false,"properties":{"exclude":{"default":[],"description":"path prefix passed through to scanners that accept it (repeatable)","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--exclude"]}},"list":{"default":false,"description":"print the derived set and each command without running anything","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--list"]}},"profile":{"description":"profile directory override; default is the live runtime's selected_profile_manifest","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root"],"type":"object"},"name":"run_gates"},{"description":"Scaffold a candidate profile from profiles/_template using the exact-copy whitelist in profiles/template-files.yaml","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"create the candidate; without it the plan is reported and nothing is written","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"emit the plan/result as one JSON document","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"profile_id":{"description":"candidate profile slug matching [a-z0-9][a-z0-9_-]* (equals the directory name)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--profile-id"]}},"root":{"description":"repository root containing profiles/","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}}},"required":["root","profile_id"],"type":"object"},"name":"scaffold_profile"},{"description":"Seal verified frozen receipt history (K12/07). --apply is a maintenance-window operation: run it only with no other Cambium or adopter writer, checker or receipt appender active against this repository.","inputSchema":{"additionalProperties":false,"properties":{"apply":{"default":false,"description":"write the seal, or with --reconcile finish the interrupted one; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"json":{"default":false,"description":"write the receipts this run produced to stdout as one canonical JSON array and move the human-readable report to stderr; receipts written, verdicts, and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"receipts":{"default":".cambium/receipts/seal-receipts.jsonl","description":"repository-relative JSONL path for this tool's own seal receipts, which never seal (default: .cambium/receipts/seal-receipts.jsonl)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"reconcile":{"default":false,"description":"finish an interrupted seal over the publication paths this tool implements; other interruptions fail closed and are resolved by the runbook in Tools/README.md","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--reconcile"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"verify":{"default":false,"description":"re-prove every sealed segment, projection and seal-receipt binding, then exit","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--verify"]}}},"required":["root"],"type":"object"},"name":"seal_receipts"},{"description":"Stamp kernel Runtime Cards","inputSchema":{"additionalProperties":false,"properties":{"acknowledge_compiled":{"default":false,"description":"after semantic regeneration/review, advance compiled_source_hash to the exact current source digest","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--acknowledge-compiled"]}},"cards_dir":{"default":"kernel/Cards","description":"Card directory relative to (default: kernel/Cards)","type":"string","x-cambium-cli":{"action":"store","option_strings":["--cards-dir"]}},"check":{"default":false,"description":"verify only; never write","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--check"]}},"root":{"description":"repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"set_version":{"description":"also set every card's compiled_from value","type":"string","x-cambium-cli":{"action":"store","option_strings":["--set-version"]}}},"required":["root"],"type":"object"},"name":"stamp_cards"},{"description":"Apply one Required Queue transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; Queue transition planning and apply both require integrator","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"batch_receipt":{"default":[],"description":"batch-review gate receipt id for open -> merge-ready; exactly one is accepted","items":{"type":"string"},"type":"array","x-cambium-cli":{"action":"append","option_strings":["--batch-receipt"]}},"close_gate_receipt":{"description":"check_batch_close receipt id required by the closed transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--close-gate-receipt"]}},"confirmation_receipt":{"description":"confirmation receipt id required by queued -> open when the batch is confirmation_required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--confirmation-receipt"]}},"delta_apply_receipt":{"description":"apply_delta receipt id required by the closed transition and by merge-ready -> open reopen","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-apply-receipt"]}},"delta_path":{"description":"repository-relative .cambium/deltas/.yaml batch delta required by open -> merge-ready","type":"string","x-cambium-cli":{"action":"store","option_strings":["--delta-path"]}},"expected_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; the write is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-sha256"]}},"expected_state_revision":{"description":"compare-and-swap guard: the state_revision the caller read from the current Queue; the write is refused when the live value differs","type":"integer","x-cambium-cli":{"action":"store","option_strings":["--expected-state-revision"],"type":"int"}},"gate_receipt":{"description":"gate receipt id: activation gate for queued -> open, Queue consistency gate for closed and for clearing revalidation-required","type":"string","x-cambium-cli":{"action":"store","option_strings":["--gate-receipt"]}},"hold_state":{"description":"target hold state; exclusive with --transition","enum":["blocked","confirmation-required","none","paused","revalidation-required"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--hold-state"]}},"id":{"description":"Required Queue batch id to transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--id"]}},"json":{"default":false,"description":"write the applied transition receipt(s) to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"reason":{"description":"non-empty rationale required by merge-ready -> open and by any non-none hold","type":"string","x-cambium-cli":{"action":"store","option_strings":["--reason"]}},"receipts":{"default":".cambium/receipts/queue-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"standards_revalidation_receipt":{"description":"check_queue --require-revalidation receipt discharging an outstanding Standards revalidation; queued -> open or revalidation-required -> none only","type":"string","x-cambium-cli":{"action":"store","option_strings":["--standards-revalidation-receipt"]}},"transition":{"description":"target lifecycle state; exclusive with --hold-state","enum":["closed","merge-ready","open"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","id"],"type":"object"},"name":"update_queue","x-cambium-mutually-exclusive":[{"dests":["transition","hold_state"],"required":true}]},{"description":"Apply one canonical task-state transition","inputSchema":{"additionalProperties":false,"properties":{"actor_role":{"default":"worker","description":"declared caller role; only integrator may apply a task-state write","enum":["integrator","worker"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--actor-role"]}},"apply":{"default":false,"description":"write the transition; omit for a dry run","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--apply"]}},"at":{"description":"transition timestamp; defaults to now in UTC","type":"string","x-cambium-cli":{"action":"store","option_strings":["--at"]}},"checkpoint_summary":{"description":"non-empty reason required by paused, blocked and cancelled, and when leaving completion-candidate for anything but complete","type":"string","x-cambium-cli":{"action":"store","option_strings":["--checkpoint-summary"]}},"expected_progress_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Progress; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-progress-sha256"]}},"expected_queue_sha256":{"description":"compare-and-swap guard: sha256: the caller read from the current Queue; --apply is refused when the live bytes differ","type":"string","x-cambium-cli":{"action":"store","option_strings":["--expected-queue-sha256"]}},"json":{"default":false,"description":"write the applied transition receipt to stdout as one canonical JSON array and move the human report to stderr; a dry run publishes no receipt and so writes nothing there; receipt writing and exit codes are unchanged","type":"boolean","x-cambium-cli":{"action":"store_true","nargs":0,"option_strings":["--json"]}},"maintenance_completion_receipt":{"description":"maintenance completion gate receipt id required by complete under maintenance completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--maintenance-completion-receipt"]}},"queue_check_receipt":{"description":"Queue completion gate receipt id required by the completion-candidate transition","type":"string","x-cambium-cli":{"action":"store","option_strings":["--queue-check-receipt"]}},"receipts":{"default":".cambium/receipts/task-transitions.jsonl","description":"receipt JSONL path under .cambium/receipts","type":"string","x-cambium-cli":{"action":"store","option_strings":["--receipts"]}},"root":{"description":"adopting repository root","type":"string","x-cambium-cli":{"action":"store","option_strings":[]}},"terminal_proof_receipt":{"description":"Terminal Proof receipt id required by complete under build completion_semantics","type":"string","x-cambium-cli":{"action":"store","option_strings":["--terminal-proof-receipt"]}},"transition":{"description":"target task state in the Progress Ledger","enum":["active","blocked","cancelled","complete","completion-candidate","paused"],"type":"string","x-cambium-cli":{"action":"store","option_strings":["--transition"]}}},"required":["root","transition"],"type":"object"},"name":"update_task"}],"transports":["stdio","streamable-http"]} diff --git a/Tools/compiled/metadata-execution-contract.json b/Tools/compiled/metadata-execution-contract.json index fb2db2c..4f15b33 100644 --- a/Tools/compiled/metadata-execution-contract.json +++ b/Tools/compiled/metadata-execution-contract.json @@ -1 +1 @@ -{"artifact":"metadata-execution-contract","capability_implementations":[{"path":"Tools/apply_amendment.py","sha256":"sha256:d541f4de5caa0b55c68817c406c820de856a675b030a716eaab10e47f3fad4d8"},{"path":"Tools/apply_delta.py","sha256":"sha256:3749db54ecc0d713c657eb32d1fe52011d65eb64e3a4c4938430344bcfe957d2"},{"path":"Tools/apply_metadata_transition.py","sha256":"sha256:71d687f1a2afb4006dc19b90bcb27e886ca46ce6e577d294802925523e7ae0cd"},{"path":"Tools/apply_task_plan.py","sha256":"sha256:99b47d8dfc2366098ebb3f7d285dec2bc84c0c834c39efea3b846a06b0a36f5d"},{"path":"Tools/card_activation.py","sha256":"sha256:a5106bf4db90eccfd078ffbd436846c753de5c1a01eb4fb3842ed934b5cecf97"},{"path":"Tools/check_batch_close.py","sha256":"sha256:bc2326400a6dde7863fd1384382475ea98fa78592cd0b67d84e3c817b5bf4d16"},{"path":"Tools/check_queue.py","sha256":"sha256:5e0db75e6b6d7b209b7764092e3c54f71d02560357d38d5b77118f772c1cc07d"},{"path":"Tools/mcp_server.py","sha256":"sha256:9242ac64abe3baf24d8e6e9586c9bf8bd08ac708e802ee6bd12de00a267db270"},{"path":"Tools/metadata_gate_runtime.py","sha256":"sha256:da4aebb718dcbb37f31116c25e6cee3e374fa1e0a3edb87ab96eac6106ab22a3"},{"path":"Tools/metadata_property_state.py","sha256":"sha256:9fa07bf32b366a0bc1797006485b78f4d614b60c97f8b05c0e3dfa1c16ba2d43"},{"path":"Tools/project_page_state.py","sha256":"sha256:77c500cfbb0435f78908f8ab680f3fa4858c2c4d54cb90ce53e5870ddcfa3de4"},{"path":"Tools/record_gate_attestation.py","sha256":"sha256:73e8ad584a4c8e77f3510c09666496c2c7f2a2dd4b24b8394d6f41f9b9a81e3e"},{"path":"Tools/record_gate_result.py","sha256":"sha256:6111c6ff8bd5bf28fdb659cc891db318c314bd878cc9b75d86c6e2b9a97ed8d0"},{"path":"Tools/register_amendment.py","sha256":"sha256:917e0df2c028908b752e58894b61237807778e169e8e452d96d70458d0317fdc"},{"path":"Tools/update_queue.py","sha256":"sha256:3680ae8592ea307542de1b86bb808cc99e1153b1b244c8aeed8680bf0f7a77ae"}],"contract_fingerprint":"sha256:806167463adb1942a22a51a805ad1ae82f18ca45b2959f6206f36876e35b5817","contract_id":"kernel-metadata-execution","field_rules":[{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].authoring_status","evidence_requirement":null,"field":"authoring_status","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].coverage_disposition","evidence_requirement":null,"field":"coverage_disposition","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":null,"field":"last_content_modified","invalidation_rule":"owner-property-state-change-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"accepted-at-utc-date"},"field":"last_content_modified","invalidation_rule":"superseded-by-later-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":null,"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"reviewed-content","content_binding":"exact-page-content-sha256","excluded_change_classes":[],"invalidation":"invalidated-by-null","protocol":"current-page-review-v1","result":"pass","target_binding":"exact-page-path","value_selector":"checked-at-utc-date"},"field":"last_reviewed","invalidation_rule":"superseded-by-review-or-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"current-review-receipt-value-v1","transition":"review-completed","value_shape":"date","write_timing":"review-evidence-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"tombstone-null"},"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"tombstone-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].next_batch","evidence_requirement":null,"field":"next_batch","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"}],"operation_capabilities":[{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_metadata_transition.py","Tools/metadata_property_state.py"],"kind":"consumer","operations":[{"operation":"typed-field-metadata-transition"}]},{"capability_id":"card-context-delivery-v1","capability_version":"1.0.2","implementation_paths":["Tools/card_activation.py","Tools/check_queue.py","Tools/mcp_server.py","Tools/update_queue.py"],"kind":"producer","operations":[]},{"capability_id":"manual-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_attestation.py"],"kind":"producer","operations":[]},{"capability_id":"registered-scan-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_result.py"],"kind":"producer","operations":[]},{"capability_id":"deterministic-gate-result-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"manual-gate-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}],"schema_version":1,"source_adapters":[{"adapter_id":"content-change-event-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]},{"adapter_id":"coverage-property-state-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":["content_fingerprint","evidence_receipt","value"]},{"adapter_id":"coverage-row-value-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":[]},{"adapter_id":"current-review-receipt-value-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]}],"temporal_order":["first_seen","last_content_modified","last_reviewed","last_verified"],"writer_capabilities":[{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}]} +{"artifact":"metadata-execution-contract","capability_implementations":[{"path":"Tools/apply_amendment.py","sha256":"sha256:d541f4de5caa0b55c68817c406c820de856a675b030a716eaab10e47f3fad4d8"},{"path":"Tools/apply_delta.py","sha256":"sha256:3749db54ecc0d713c657eb32d1fe52011d65eb64e3a4c4938430344bcfe957d2"},{"path":"Tools/apply_metadata_transition.py","sha256":"sha256:71d687f1a2afb4006dc19b90bcb27e886ca46ce6e577d294802925523e7ae0cd"},{"path":"Tools/apply_task_plan.py","sha256":"sha256:99b47d8dfc2366098ebb3f7d285dec2bc84c0c834c39efea3b846a06b0a36f5d"},{"path":"Tools/card_activation.py","sha256":"sha256:a5106bf4db90eccfd078ffbd436846c753de5c1a01eb4fb3842ed934b5cecf97"},{"path":"Tools/check_batch_close.py","sha256":"sha256:bc2326400a6dde7863fd1384382475ea98fa78592cd0b67d84e3c817b5bf4d16"},{"path":"Tools/check_queue.py","sha256":"sha256:5eff5f82b39e03669c346931c6b42236d7eb7acfe9d711e327e895bcf78b32a1"},{"path":"Tools/mcp_server.py","sha256":"sha256:9242ac64abe3baf24d8e6e9586c9bf8bd08ac708e802ee6bd12de00a267db270"},{"path":"Tools/metadata_gate_runtime.py","sha256":"sha256:da4aebb718dcbb37f31116c25e6cee3e374fa1e0a3edb87ab96eac6106ab22a3"},{"path":"Tools/metadata_property_state.py","sha256":"sha256:9fa07bf32b366a0bc1797006485b78f4d614b60c97f8b05c0e3dfa1c16ba2d43"},{"path":"Tools/project_page_state.py","sha256":"sha256:77c500cfbb0435f78908f8ab680f3fa4858c2c4d54cb90ce53e5870ddcfa3de4"},{"path":"Tools/record_gate_attestation.py","sha256":"sha256:73e8ad584a4c8e77f3510c09666496c2c7f2a2dd4b24b8394d6f41f9b9a81e3e"},{"path":"Tools/record_gate_result.py","sha256":"sha256:6111c6ff8bd5bf28fdb659cc891db318c314bd878cc9b75d86c6e2b9a97ed8d0"},{"path":"Tools/register_amendment.py","sha256":"sha256:917e0df2c028908b752e58894b61237807778e169e8e452d96d70458d0317fdc"},{"path":"Tools/update_queue.py","sha256":"sha256:3680ae8592ea307542de1b86bb808cc99e1153b1b244c8aeed8680bf0f7a77ae"}],"contract_fingerprint":"sha256:b3bd67c35d09c0f6f80c4e78ec8ab781c25738577b8ef26aa724a20ceba0ed8b","contract_id":"kernel-metadata-execution","field_rules":[{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].authoring_status","evidence_requirement":null,"field":"authoring_status","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].coverage_disposition","evidence_requirement":null,"field":"coverage_disposition","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":null,"field":"last_content_modified","invalidation_rule":"owner-property-state-change-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_content_modified","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"accepted-at-utc-date"},"field":"last_content_modified","invalidation_rule":"superseded-by-later-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":null,"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"upsert-exact-or-remove-v1","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection","value_shape":"date","write_timing":"after-owner-state-transition","writer_capability":"project-page-state-v2"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"reviewed-content","content_binding":"exact-page-content-sha256","excluded_change_classes":[],"invalidation":"invalidated-by-null","protocol":"current-page-review-v1","result":"pass","target_binding":"exact-page-path","value_selector":"checked-at-utc-date"},"field":"last_reviewed","invalidation_rule":"superseded-by-review-or-semantic-content-change-v1","reconcile_policy":"upsert-owner-property-state-v1","source_adapter":"current-review-receipt-value-v1","transition":"review-completed","value_shape":"date","write_timing":"review-evidence-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"evidence-projection","canonical_owner":"coverage-ledger.pages[].property_state.last_reviewed","evidence_requirement":{"change_scope":"semantic-content","content_binding":"after-page-content-sha256","excluded_change_classes":["projection-only","tool-controlled-metadata-only"],"invalidation":"current-content-fingerprint","protocol":"semantic-content-change-v1","result":"pass","target_binding":"exact-page-path","value_selector":"tombstone-null"},"field":"last_reviewed","invalidation_rule":"semantic-content-change-tombstone-v1","reconcile_policy":"tombstone-owner-property-state-v1","source_adapter":"content-change-event-v1","transition":"semantic-content-change","value_shape":"date","write_timing":"semantic-content-acceptance","writer_capability":"metadata-transition-integrator-v1"},{"authority_class":"ledger-projection","canonical_owner":"coverage-ledger.pages[].next_batch","evidence_requirement":null,"field":"next_batch","invalidation_rule":"owner-value-change-v1","reconcile_policy":"existing-copy-exact-or-remove-v1","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection","value_shape":"scalar-string-or-null","write_timing":"batch-close-after-owner-update","writer_capability":"project-page-state-v2"}],"operation_capabilities":[{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_metadata_transition.py","Tools/metadata_property_state.py"],"kind":"consumer","operations":[{"operation":"typed-field-metadata-transition"}]},{"capability_id":"card-context-delivery-v1","capability_version":"1.0.2","implementation_paths":["Tools/card_activation.py","Tools/check_queue.py","Tools/mcp_server.py","Tools/update_queue.py"],"kind":"producer","operations":[]},{"capability_id":"manual-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_attestation.py"],"kind":"producer","operations":[]},{"capability_id":"registered-scan-v1","capability_version":"1.0.0","implementation_paths":["Tools/record_gate_result.py"],"kind":"producer","operations":[]},{"capability_id":"deterministic-gate-result-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"manual-gate-attestation-v1","capability_version":"1.0.0","implementation_paths":["Tools/metadata_gate_runtime.py"],"kind":"receipt-schema","operations":[]},{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}],"schema_version":1,"source_adapters":[{"adapter_id":"content-change-event-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]},{"adapter_id":"coverage-property-state-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":["content_fingerprint","evidence_receipt","value"]},{"adapter_id":"coverage-row-value-v1","authority_class":"ledger-projection","evidence_required":false,"owner_record_keys":[]},{"adapter_id":"current-review-receipt-value-v1","authority_class":"evidence-projection","evidence_required":true,"owner_record_keys":[]}],"temporal_order":["first_seen","last_content_modified","last_reviewed","last_verified"],"writer_capabilities":[{"capability_id":"legacy-property-adoption-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_amendment.py","Tools/apply_task_plan.py","Tools/metadata_property_state.py","Tools/project_page_state.py","Tools/register_amendment.py"],"kind":"writer","operations":[{"operation":"legacy-property-adoption-v1"}]},{"capability_id":"metadata-transition-integrator-v1","capability_version":"1.0.0","implementation_paths":["Tools/apply_delta.py","Tools/apply_metadata_transition.py","Tools/check_batch_close.py","Tools/metadata_property_state.py","Tools/update_queue.py"],"kind":"writer","operations":[{"field":"last_content_modified","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"content-change-event-v1","transition":"semantic-content-change"},{"field":"last_reviewed","source_adapter":"current-review-receipt-value-v1","transition":"review-completed"}]},{"capability_id":"project-page-state-v2","capability_version":"2.0.0","implementation_paths":["Tools/metadata_property_state.py","Tools/project_page_state.py"],"kind":"writer","operations":[{"field":"authoring_status","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"coverage_disposition","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"field":"last_content_modified","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"last_reviewed","source_adapter":"coverage-property-state-v1","transition":"owner-to-page-projection"},{"field":"next_batch","source_adapter":"coverage-row-value-v1","transition":"owner-to-page-projection"},{"operation":"profile-extension-enum-owner-projection-v1"}]}]} diff --git a/Tools/tests/test_apply_delta_runtime.py b/Tools/tests/test_apply_delta_runtime.py index a9c7ee5..917aca8 100644 --- a/Tools/tests/test_apply_delta_runtime.py +++ b/Tools/tests/test_apply_delta_runtime.py @@ -732,7 +732,8 @@ def own_and_external_then_fail(path, receipts, exclusive=False): lock["operation_receipt"]["status"]) self.assertTrue(lock["operation_receipt"]["matching_receipt"]) self.assertEqual( - {"coverage": "before", "progress": "before", "queue": "before"}, + {"coverage": "before", "progress": "before", "queue": "before", + "standards": "before"}, {name: phase["phase"] for name, phase in lock["state_phases"].items()}, ) From 19949020363b2d50745914c1a17cc107b6d3b2e5 Mon Sep 17 00:00:00 2001 From: KimGLee <05_bolster_inkling@icloud.com> Date: Sat, 22 Aug 2026 00:38:29 +0800 Subject: [PATCH 4/4] Align Standards recovery expectation --- Tools/tests/test_update_queue.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Tools/tests/test_update_queue.py b/Tools/tests/test_update_queue.py index 29a3435..866de54 100644 --- a/Tools/tests/test_update_queue.py +++ b/Tools/tests/test_update_queue.py @@ -1699,7 +1699,7 @@ def own_and_external_then_fail(path, receipts, **kwargs): self.assertTrue(lock["operation_receipt"]["matching_receipt"]) self.assertEqual( {"coverage": "before", "progress": "planned-after", - "queue": "planned-after", "standards": "unavailable"}, + "queue": "planned-after", "standards": "before"}, {name: phase["phase"] for name, phase in lock["state_phases"].items()}, )