fix: align log cli API surface

.printing-press-patches.json

@@ -0,0 +1,37 @@
+{
+  "schema_version": 1,
+  "applied_at": "2026-05-29",
+  "base_run_id": "20260517-103932",
+  "base_printing_press_version": "4.8.0",
+  "patches": [
+    {
+      "id": "log-api-parity",
+      "summary": "Update the CLI and MCP surface for the current log-node API.",
+      "reason": "The public log API added proof recovery, signed-note vkey publication, JSON Feed, and SSE stream endpoints after this generated CLI was first published. POST /v1/entries also now accepts a bare signed atrib record and returns a proof bundle.",
+      "files": [
+        "spec.yaml",
+        "README.md",
+        "SKILL.md",
+        "internal/cli/promoted_entries.go",
+        "internal/cli/promoted_feed-json.go",
+        "internal/cli/promoted_log-pubkey.go",
+        "internal/cli/promoted_proof.go",
+        "internal/cli/promoted_stream.go",
+        "internal/cli/root.go",
+        "internal/cli/which.go",
+        "internal/mcp/tools.go",
+        ".printing-press.json"
+      ],
+      "validated_outcome": "Dry-run generation parsed 13 resources and 14 endpoints. Local tests and live smoke checks cover the finite endpoints and SSE ready event."
+    },
+    {
+      "id": "api-promoted-endpoints",
+      "summary": "Make api discovery list promoted endpoint commands.",
+      "reason": "The generated api command only listed hidden resource parents, so it missed top-level promoted endpoints such as checkpoint, pubkey, recent, and stats.",
+      "files": [
+        "internal/cli/api_discovery.go"
+      ],
+      "validated_outcome": "atrib-log-pp-cli api lists promoted endpoints as interfaces."
+    }
+  ]
+}

.printing-press.json

@@ -8,14 +8,14 @@
   "owner": "nader-helmy",
   "printer": "creatornader",
   "printer_name": "Nader Helmy",
-  "spec_path": "./atrib-log-openapi.yaml",
+  "spec_path": "./spec.yaml",
   "spec_format": "openapi3",
-  "spec_checksum": "sha256:52f791859856a9ef338a8de9f1559e96e2a0b0d9b48e735fd0fa6bdc9f0b3257",
+  "spec_checksum": "sha256:3ed76c7644d78eb10a138a20600b28b4d466ec9a0b636abcafdb1f3075f0fc8f",
   "run_id": "20260517-103932",
   "mcp_binary": "atrib-log-pp-mcp",
-  "mcp_tool_count": 10,
-  "mcp_public_tool_count": 10,
+  "mcp_tool_count": 13,
+  "mcp_public_tool_count": 13,
   "mcp_ready": "full",
   "api_version": "1.0",
   "auth_type": "none"
-}
+}

README.md

@@ -1,14 +1,14 @@
 # atrib-log-pp-cli
 
-Developer CLI for the [atrib](https://github.com/creatornader/atrib) transparency log at `log.atrib.dev`. Wraps the public log API (signed checkpoint, recent entries, lookup by hash, by context, by creator, Merkle tile retrieval) with local SQLite mirroring, full-text search, and agent-friendly defaults.
+Developer CLI for the [atrib](https://github.com/creatornader/atrib) transparency log at `log.atrib.dev`. Wraps the public log API (signed checkpoint, log public keys, stats, recent entries, lookup by hash, inclusion-proof recovery, by context, by creator, JSON Feed, SSE stream, Merkle tile retrieval) with local SQLite mirroring, full-text search, and agent-friendly defaults.
 
 Generated by [Printing Press](https://github.com/mvanhorn/cli-printing-press) from a hand-authored OpenAPI spec for `log.atrib.dev`.
 
 ## What this is and isn't
 
 **This is** the developer-facing CLI for direct interaction with `log.atrib.dev`. Use it for batch queries, verification, debugging, dogfooding the public log API, and one-off "show me the last N entries by signer X" type questions.
 
-**This is NOT** a replacement for the [`@atrib/*`](https://github.com/creatornader/atrib) MCP cognitive primitives (`emit`, `annotate`, `revise`, `recall`, `trace`, `summarize`). Those are the agent-facing surface, designed around the 6 verbs an agent reasons in. This CLI is the operator-facing surface, designed around the HTTP API endpoints. They are complementary:
+**This is NOT** a replacement for the [`@atrib/*`](https://github.com/creatornader/atrib) MCP cognitive primitives (`emit`, `annotate`, `revise`, `recall`, `trace`, `summarize`, `verify`). Those are the agent-facing surface, designed around the seven primitives an agent reasons in. This CLI is the operator-facing surface, designed around the HTTP API endpoints. They are complementary:
 
 - Agent doing cognitive work → use the MCP primitives
 - Human or script interacting with the log → use this CLI
@@ -37,11 +37,15 @@ The binary lands in `$GOPATH/bin` (typically `~/go/bin/`). Ensure that's on your
 ```sh
 # Live API queries
 atrib-log-pp-cli checkpoint              # signed tree head
+atrib-log-pp-cli log-pubkey              # C2SP signed-note vkey
 atrib-log-pp-cli stats                   # tree size + entries by event type
 atrib-log-pp-cli recent --limit 10       # most recent entries
 atrib-log-pp-cli lookup <record-hash>    # entry by hash
+atrib-log-pp-cli proof <record-hash>     # recover inclusion proof
 atrib-log-pp-cli by-context <context-id> # all entries in a session
 atrib-log-pp-cli by-creator <key>        # all entries by signer
+atrib-log-pp-cli feed-json --limit 10    # JSON Feed 1.1
+atrib-log-pp-cli stream                  # raw Server-Sent Events
 
 # Local mirror + search
 atrib-log-pp-cli sync                    # mirror to local SQLite
@@ -77,7 +81,7 @@ Configure in Claude Desktop's `claude_desktop_config.json`:
 }
 ```
 
-The MCP server exposes the same command surface as the CLI. Note: for *agent cognitive work* (emitting signed records, recalling past actions, etc.), the [`@atrib/*`](https://github.com/creatornader/atrib) MCP servers are the right surface, not this one.
+The MCP server exposes the same finite command surface as the CLI. The raw SSE stream command stays CLI-only because MCP tool calls expect a bounded response. Note: for *agent cognitive work* (emitting signed records, recalling past actions, etc.), the [`@atrib/*`](https://github.com/creatornader/atrib) MCP servers are the right surface, not this one.
 
 ## Configuration
 

SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pp-atrib-log
-description: "Printing Press CLI for Atrib Log. atrib transparency log — Sigsum-style append-only Merkle log of signed agent action records. Each entry is a..."
+description: "Printing Press CLI for Atrib Log. atrib transparency log - Sigsum-style append-only Merkle log of signed agent action records. Each entry is a..."
 author: "Nader Helmy"
 license: "Apache-2.0"
 argument-hint: "<command> [args] | install cli|mcp"
@@ -12,7 +12,7 @@ metadata:
         - atrib-log-pp-cli
 ---
 
-# Atrib Log — Printing Press CLI
+# Atrib Log - Printing Press CLI
 
 ## Prerequisites: Install the CLI
 
@@ -29,48 +29,65 @@ If the `npx` install fails before this CLI has a public-library category, instal
 
 If `--version` reports "command not found" after install, the install step did not put the binary on `$PATH`. Do not proceed with skill commands until verification succeeds.
 
-atrib transparency log — Sigsum-style append-only Merkle log of signed
+atrib transparency log - Sigsum-style append-only Merkle log of signed
 agent action records. Each entry is a cryptographically signed record
-of an LLM agent action (tool call, observation, annotation, revision).
+of an LLM agent action (tool call, transaction, observation, annotation,
+revision, or directory anchor).
 
 ## Command Reference
 
-**by-context** — Manage by context
+**by-context** - Manage by context
 
-- `atrib-log-pp-cli by-context <hex>` — All entries in a context (session)
+- `atrib-log-pp-cli by-context <hex>` - All entries in a context (session)
 
-**by-creator** — Manage by creator
+**by-creator** - Manage by creator
 
-- `atrib-log-pp-cli by-creator <key>` — All entries by signer (creator key)
+- `atrib-log-pp-cli by-creator <key>` - All entries by signer (creator key)
 
-**checkpoint** — Manage checkpoint
+**checkpoint** - Manage checkpoint
 
-- `atrib-log-pp-cli checkpoint` — Returns the current signed checkpoint (tree size + root hash + log signature). Use this to anchor your local view of...
+- `atrib-log-pp-cli checkpoint` - Returns the current signed checkpoint (tree size + root hash + log signature). Use this to anchor your local view of...
 
-**entries** — Manage entries
+**entries** - Manage entries
 
-- `atrib-log-pp-cli entries` — Write path. Submit a signed record for inclusion in the log. Returns the assigned index + record_hash on success.
+- `atrib-log-pp-cli entries` - Write path. Submit a signed record for inclusion in the log. Returns an inclusion-proof bundle on success.
 
-**lookup** — Manage lookup
+**feed-json** - Manage JSON Feed
 
-- `atrib-log-pp-cli lookup <hex>` — Lookup entry by record hash
+- `atrib-log-pp-cli feed-json` - JSON Feed 1.1 companion for newest-first decoded log entries.
 
-**pubkey** — Manage pubkey
+**log-pubkey** - Manage C2SP log public key
 
-- `atrib-log-pp-cli pubkey` — Get verification public key
+- `atrib-log-pp-cli log-pubkey` - Get the log public key in signed-note vkey format.
 
-**recent** — Manage recent
+**lookup** - Manage lookup
 
-- `atrib-log-pp-cli recent` — Most recent entries
+- `atrib-log-pp-cli lookup <hex>` - Lookup entry by record hash
 
-**stats** — Manage stats
+**proof** - Manage proof recovery
 
-- `atrib-log-pp-cli stats` — Tree statistics
+- `atrib-log-pp-cli proof <hex>` - Recover an inclusion-proof bundle for a record already in the log.
 
-**tile** — Manage tile
+**pubkey** - Manage pubkey
 
-- `atrib-log-pp-cli tile get` — Sigsum-style Merkle tile at level L, position N
-- `atrib-log-pp-cli tile get-entries` — Get entries within a tile (leaf-level)
+- `atrib-log-pp-cli pubkey` - Get verification public key
+
+**recent** - Manage recent
+
+- `atrib-log-pp-cli recent` - Most recent entries
+
+**stats** - Manage stats
+
+- `atrib-log-pp-cli stats` - Tree statistics
+
+**stream** - Manage SSE stream
+
+- `atrib-log-pp-cli stream` - Stream new decoded log entries as raw Server-Sent Events.
+
+**tile** - Manage tile
+
+- `atrib-log-pp-cli tile get` - Sigsum-style Merkle tile at level L, position N
+- `atrib-log-pp-cli tile get-entries` - Get entries within a tile (leaf-level)
 
 
 ### Finding the right command
@@ -81,7 +98,7 @@ When you know what you want to do but not which command does it, ask the CLI dir
 atrib-log-pp-cli which "<capability in your own words>"
 ```
 
-`which` resolves a natural-language capability query to the best matching command from this CLI's curated feature index. Exit code `0` means at least one match; exit code `2` means no confident match — fall back to `--help` or use a narrower query.
+`which` resolves a natural-language capability query to the best matching command from this CLI's curated feature index. Exit code `0` means at least one match; exit code `2` means no confident match - fall back to `--help` or use a narrower query.
 
 ## Auth Setup
 
@@ -93,16 +110,16 @@ Run `atrib-log-pp-cli doctor` to verify setup.
 
 Add `--agent` to any command. Expands to: `--json --compact --no-input --no-color --yes`.
 
-- **Pipeable** — JSON on stdout, errors on stderr
-- **Filterable** — `--select` keeps a subset of fields. Dotted paths descend into nested structures; arrays traverse element-wise. Critical for keeping context small on verbose APIs:
+- **Pipeable** - JSON on stdout, errors on stderr
+- **Filterable** - `--select` keeps a subset of fields. Dotted paths descend into nested structures; arrays traverse element-wise. Critical for keeping context small on verbose APIs:
 
   ```bash
   atrib-log-pp-cli by-context mock-value --agent --select id,name,status
   ```
-- **Previewable** — `--dry-run` shows the request without sending
-- **Offline-friendly** — sync/search commands can use the local SQLite store when available
-- **Non-interactive** — never prompts, every input is a flag
-- **Explicit retries** — use `--idempotent` only when an already-existing create should count as success
+- **Previewable** - `--dry-run` shows the request without sending
+- **Offline-friendly** - sync/search commands can use the local SQLite store when available
+- **Non-interactive** - never prompts, every input is a flag
+- **Explicit retries** - use `--idempotent` only when an already-existing create should count as success
 
 ### Response envelope
 
@@ -115,7 +132,7 @@ Commands that read from the local store or the API wrap output in a provenance e
 }
 ```
 
-Parse `.results` for data and `.meta.source` to know whether it's live or local. A human-readable `N results (live)` summary is printed to stderr only when stdout is a terminal AND no machine-format flag (`--json`, `--csv`, `--compact`, `--quiet`, `--plain`, `--select`) is set — piped/agent consumers and explicit-format runs get pure JSON on stdout.
+Parse `.results` for data and `.meta.source` to know whether it's live or local. A human-readable `N results (live)` summary is printed to stderr only when stdout is a terminal AND no machine-format flag (`--json`, `--csv`, `--compact`, `--quiet`, `--plain`, `--select`) is set - piped/agent consumers and explicit-format runs get pure JSON on stdout.
 
 ## Agent Feedback