Native and npm CLI Commands

Native and npm provide raw, unpinned bundle, and externally pinned bundle vouch verify through shared Rust. Only Native issues, re-executes, and gates; bundle re-execution and gate require the complete external source/input request.

Current guarantees

lispex [FILE|-] evaluates source; receipt records the native execution envelope; lower and eval-graph operate on the checked subset.
Native provides the full namespaced chain: vouch issue, flag-free vouch verify, vouch verify --reexecute, vouch gate --require-decision, and vouch inspect. npm provides authenticated flag-free vouch verify, structural vouch inspect, and corpus vouch replay; npm rejects issue, --reexecute, and gate before artifact I/O.
For flag-free authenticated verify, exits are 0 for authenticated and diagnostic-promotion-eligible, 10 for authenticated but diagnostic-promotion-ineligible, 1 for rejection, 2 for usage before artifact I/O, and 3 for input/output or report-publication failure. Both 0 and 10 authenticate; neither grants authority.
The flat npm lispex verify RECEIPT remains an unsigned structural compatibility command. It is not an alias for namespaced authenticated lispex vouch verify.
A successful --reexecute report has authentication.status set to authenticated, reexecution.status set to execution-agreed, fixed observation_scope csk.vouch-complete-transcript/v0, and comparison.current_vs_signed set to agree.
vouch gate requires all raw context paths plus --require-decision approve|deny|review|invalid-input and --report-out. Its csk.native-gate-report/v0 separates authentication, re-execution, and gate status and records the fixed basis csk.current-native-agreement/v0.
File and stdin identities are recorded explicitly where an artifact contract requires them.
Use lispex vouch policy create with one named SPKI file, repeated explicit engine/source flags, and a new output; then use policy check on the exact bytes. Success emits no stdout. Exit 2 is usage, 3 is I/O/resource/publication failure, and 1 is invalid configuration.
For Native bundle authority, vouch verify --reexecute and vouch gate require both --source RULE and --input INPUT. Missing or partial pairs are usage exit 2 before any named artifact is opened. Flag-free vouch verify --bundle remains supported authentication-only behavior in Native and npm.

Command boundaries

Command	Reads	Writes / does not establish
lispex [FILE\|-]	Lispex source bytes	canonical result/stdout and diagnostics; no receipt
lispex receipt FILE	source bytes	native execution receipt; not a Vouch differential receipt
lispex diff-receipt --input I RULE	checked-profile rule and datum	csk.differential-receipt/v0; not authenticity
lispex verify RECEIPT	receipt JSON and optional source	consistency verdict; does not re-run policy
lispex issue-native ...	checked-profile rule, pinned input, profile, and local PKCS#8 key handle	atomic payload, DSSE envelope, and issue report; native release binary only
lispex verify-native ...	DSSE envelope, consumer trust policy, source, input, profile, and expected engine context	authentication report for exact checked context; no identity, time, deployment, or policy-correctness proof
lispex verify-bridge REPORT	Bridge report and bound artifacts	Bridge consistency verdict; no external-engine execution

Boundaries

For vouch gate, exit 0 means a live grant matched the required decision; 10 means authentication succeeded but no grant was minted; 1 means authentication rejection; 2 means usage error; and 3 means I/O, execution, or report-publication failure. A report is diagnostic output and cannot be reused as gate input.