Native and npm CLI Commands

Current guarantees

• lispex [FILE|-] evaluates source; receipt records the native execution envelope; lower and eval-graph operate on the checked subset.
• Native provides the full namespaced chain: vouch issue, flag-free vouch verify, vouch verify --reexecute, vouch gate --require-decision, and vouch inspect. npm provides authenticated flag-free vouch verify, structural vouch inspect, and corpus vouch replay; npm rejects issue, --reexecute, and gate before artifact I/O.
• For flag-free authenticated verify, exits are 0 for authenticated and diagnostic-promotion-eligible, 10 for authenticated but diagnostic-promotion-ineligible, 1 for rejection, 2 for usage before artifact I/O, and 3 for input/output or report-publication failure. Both 0 and 10 authenticate; neither grants authority.
• The flat npm lispex verify RECEIPT remains an unsigned structural compatibility command. It is not an alias for namespaced authenticated lispex vouch verify.
• A successful --reexecute report has authentication.status set to authenticated, reexecution.status set to execution-agreed, fixed observation_scope csk.vouch-complete-transcript/v0, and comparison.current_vs_signed set to agree.
• vouch gate requires all raw context paths plus --require-decision approve|deny|review|invalid-input and --report-out. Its csk.native-gate-report/v0 separates authentication, re-execution, and gate status and records the fixed basis csk.current-native-agreement/v0.
• File and stdin identities are recorded explicitly where an artifact contract requires them.
• Use lispex vouch policy create with one named SPKI file, repeated explicit engine/source flags, and a new output; then use policy check on the exact bytes. Success emits no stdout. Exit 2 is usage, 3 is I/O/resource/publication failure, and 1 is invalid configuration.
• For Native bundle authority, vouch verify --reexecute and vouch gate require both --source RULE and --input INPUT. Missing or partial pairs are usage exit 2 before any named artifact is opened. Flag-free vouch verify --bundle remains supported authentication-only behavior in Native and npm.
• Native and npm image commands use named paths: image encode --source SOURCE --out IMAGE, image inspect --image IMAGE, image decode --image IMAGE --out SOURCE, and run --image IMAGE. Encode requires .lspx.png for one page or .lspx-images.zip for a page set. Image usage errors exit 2, validation or suffix failures exit 1, and I/O, resource, or no-clobber publication failures exit 3.
• Where a Vouch command accepts source context, choose exactly one of --source RULE or --source-image IMAGE. A source image is read under the image bound and fully proved before recovered bytes enter identity, policy, issuance, authentication, request binding, re-execution, or gate evaluation.
• For pinned bundle verify, Native re-execution, and gate, --source-image IMAGE still requires the separately supplied --input INPUT. An unpinned bundle remains authentication-only and cannot reach execution or a grant.

Command boundaries

Boundaries

• For vouch gate, exit 0 means a live grant matched the required decision; 10 means authentication succeeded but no grant was minted; 1 means authentication rejection; 2 means usage error; and 3 means I/O, execution, or report-publication failure. A report is diagnostic output and cannot be reused as gate input.