{
  "schema": "KTAPEOUT-CLI-COMMAND-CONTRACTS-V1",
  "protocol_semver": "0.5.0",
  "default_network": "testnet-10",
  "commands": [
    {"command":"init","implementation_status":"Rust canonical public command; Python is conformance-only","options":["--template","--network","--output","--profile-lock","--profile-package"],"purpose":"Create a local project skeleton, optional verified Developer Lock binding or Profile-package-to-lock binding and deterministic workflow","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["dev workflow"]},
    {"command":"dev","implementation_status":"Rust local workflow validation; no signing/broadcast","subcommands":["workflow"],"purpose":"Validate a generated workflow, manifest and optional Developer Lock before external publish","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["external Bridge/Operator publish boundary"]},
    {"command":"app","implementation_status":"Rust canonical public command; content-preflight and content-state-commitment are read-only and fail-closed","rust_subcommands":["scaffold","quickstart","validate","check","inspect","test","simulate","preflight","content-preflight","content-state-commitment","estimate","plan","compose-preflight"],"purpose":"Build, validate, test, preflight and plan an application; content commands verify the local content/profile boundary without claiming L1 admission","network_effect":"NONE|READ","requires_bridge":"optional","requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["artifact build","name normalize","deploy plan"]},
    {"command":"profile","implementation_status":"Python conformance tooling implements inspect/search/save/migrate, contract/effect/catalog/recipe/keyring/trust-root/adoption verification, deterministic composition, canonical Recipe/adoption persistence, exact Package-backed ApplicationLock V1/V2 creation, component signature closure, threshold-signed TrustRootUpdateV2, scoped PublisherDelegationV2 bound to the concrete PublisherKeyring, CatalogHead/MirrorObservation comparison, VerificationAttestation and RecipePublication lineage verification, bounded ArtifactAvailabilityManifest, air-gapped replay bundle, signed risk-tiered ObservationBundle, bounded EffectProofAdapter and VerifiedRecipeCatalog verification; VERIFIED save requires component closure; signing, publishing and L1 admission remain external","subcommands":["inspect","search","save","migrate","contract-verify","contract-sign-payload","effect-verify","recipe-create","recipe-compose","compose","graph","recipe-verify","recipe-sign-payload","keyring-verify","keyring-sign-payload","trust-root-update-verify","publisher-delegation-verify","catalog-head-verify","catalog-head-compare","mirror-observation-verify","attestation-verify","recipe-publication-verify","artifact-availability-verify","replay-bundle-verify","observation-bundle-verify","effect-proof-verify","recipe-catalog-verify","recipe-catalog-search","component-closure-verify","conflict-check","explain","catalog-verify","catalog-sign-payload","catalog-search","adoption-project","adoption-sign-payload","adoption-verify","lock-v2","application-lock","application-lock-v2"],"options":["--output","--scope","--query","--publisher-keyring","--component-keyring","--source-keyring","--source-manifest","--root-public-key","--trust-root","--trust-root-predecessor","--predecessor","--package-dir","--network-policy-id","--created-at","--runtime-digest","--compiler-lock-digest","--dependency-root","--adapter-root","--abi-root","--vector-root","--package-registry-root","--at","--root","--manifest"],"purpose":"Inspect, search, compose, save, migrate, lock, verify, replay and apply risk-tiered read policy to reusable Profiles and Recipes","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["artifact build"]},
    {"command":"artifact","purpose":"Build and verify deterministic application artifacts","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["release create","deploy plan"]},
    {"command":"name","implementation_status":"Rust canonical public command covers normalize/key, ingress alias create/verify, quote, full ApplicationNameDeed and candidate CompactNameDeed register/transfer/rebind/release planning, compact admission evaluation, lifecycle-plan, structural readback and dual-RPC evidence/lifecycle inspection, plus publication preflight/operation planning; local plans do not prove L1 authority, Compact admission, parent-namespace authorization or isolated Deed release","rust_subcommands":["normalize","key","alias-create","alias-verify","quote","deed-register-plan","deed-transfer-plan","deed-rebind-plan","deed-release-plan","compact-name-deed-register-plan","compact-name-deed-transfer-plan","compact-name-deed-rebind-plan","compact-name-deed-release-plan","compact-admission-status","evidence-verify","inspect-lifecycle","lifecycle-plan","verify-readback","publication-preflight","publication-operation-plan"],"conformance_only_python_subcommands":[],"purpose":"Normalize names and create unsigned naming/lifecycle plans; unsupported covenant branches fail closed and report the required Profile/codec/readback upgrade","network_effect":"NONE|READ","requires_bridge":"only with --l1","requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["deploy preflight"]},
    {"command":"release","purpose":"Create and verify immutable application releases","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["deploy plan"]},
    {"command":"deploy","implementation_status":"Rust plan/preflight/readback implemented; submit is fail-closed external boundary","subcommands":["plan","preflight","submit","readback"],"purpose":"Orchestrate a L1 deployment through external signer/operator","network_effect":"NONE|READ|WRITE","requires_bridge":true,"requires_wallet":"external only","signing_allowed":"external only","broadcast":"explicit submit only","idempotent":false,"safe_to_retry":"read-only stages only","next":["deploy readback"]},
    {"command":"publish","implementation_status":"Rust is the only public CLI; complete local publish lifecycle parity is implemented for the non-signing boundary; native operator, signing and broadcast remain external","rust_subcommands":["policy-verify","plan","preflight","bind","reserve","release-reservation","recover","status","receipt-verify"],"conformance_only_python_subcommands":[],"subcommands":["policy-verify","plan","preflight","reserve","bind","release-reservation","recover","status","receipt-verify"],"purpose":"Create a network-bound DeliveryIntent, bind an exact unsigned OperatorPlan to a durable local operation journal, locally reserve or release exact inputs, verify receipts and perform read-only journal recovery assessment","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["external operator native preflight"]},
    {"command":"run","purpose":"Run local, replay or walletless application sessions","network_effect":"NONE|READ","requires_bridge":"read-only bridge only","requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["app test"]},
    {"command":"bridge","implementation_status":"proof/readback verification implemented; live RPC resolver adapter remains external","subcommands":["verify-evidence","verify-readback"],"purpose":"Advanced L1 evidence and readback verification boundary","network_effect":"NONE","requires_bridge":"external evidence or readback only","requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["deploy readback"]},
    {"command":"discovery","implementation_status":"local catalog, metadata validation, hashing and legacy migration; no indexer or L1 writer","subcommands":["catalog","validate","hash","migrate-unclassified"],"purpose":"Validate advisory application categories and access surfaces without granting capabilities or changing URI/application identity","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["app check","name normalize"]},
    {"command":"evidence","purpose":"Inspect and verify receipts and evidence","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":["doctor"]},
    {"command":"doctor","purpose":"Explain failures and safe next actions","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":[]},
    {"command":"test","implementation_status":"Python conformance-only facade; Rust public CLI uses cargo test and ktape app test","subcommands":["solver","profiles","ai","runtime","all"],"purpose":"Run bounded deterministic Python core verification suites without manual import-path setup; browser/RPC/operator suites remain explicit integration commands","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":[]},
    {"command":"ai","implementation_status":"requirements reduction, context export and delivery context implemented; neither command signs, broadcasts or reads wallet secrets","subcommands":["requirements","context export","context delivery"],"purpose":"Reduce a source manifest into bounded requirements/MVP facts or export machine-readable delivery context","network_effect":"NONE","requires_bridge":false,"requires_wallet":false,"signing_allowed":false,"broadcast":false,"idempotent":true,"safe_to_retry":true,"next":[]}
  ]
}