@cachly-dev/mcp-server 0.9.2 → 0.9.4

package/src/index.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { randomUUID } from 'node:crypto';
-import { createHash } from 'node:crypto';
+import { createHash, createHmac } from 'node:crypto';
 import { readdir, readFile, stat } from 'node:fs/promises';
 import { readFileSync } from 'node:fs';
 import { execSync } from 'node:child_process';
@@ -55,7 +55,31 @@ import { Redis } from 'ioredis';
 const API_URL = process.env.CACHLY_API_URL ?? 'https://api.cachly.dev';
 const JWT = process.env.CACHLY_JWT ?? '';
 const EMBED_MODEL = process.env.CACHLY_EMBED_MODEL ?? '';
-const CURRENT_VERSION = '0.9.2';
+const CURRENT_VERSION = '0.9.4';
+
+// ── Default Instance Resolution (for Smithery & single-credential setups) ────
+// When CACHLY_BRAIN_INSTANCE_ID is set, tools can omit the instance_id parameter.
+// When neither is set, we auto-fetch the first running instance once per process.
+let _defaultInstanceId: string = process.env.CACHLY_BRAIN_INSTANCE_ID ?? '';
+let _defaultInstanceFetched = false;
+
+async function resolveDefaultInstanceId(): Promise<string> {
+  if (_defaultInstanceId) return _defaultInstanceId;
+  if (_defaultInstanceFetched) return '';
+  _defaultInstanceFetched = true;
+  if (!JWT) return '';
+  try {
+    const res = await fetch(`${API_URL}/api/v1/instances`, {
+      headers: { Authorization: `Bearer ${JWT}`, Accept: 'application/json' },
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!res.ok) return '';
+    const data = await res.json() as { data?: Array<{ id: string; status: string }> };
+    const running = (data?.data ?? []).filter(i => i.status === 'running');
+    if (running.length > 0) { _defaultInstanceId = running[0].id; return _defaultInstanceId; }
+  } catch { /* non-fatal — caller will surface missing instance_id error */ }
+  return '';
+}
 /**
  * ┌──────────────────────────────────────────────────────────────────────┐
  * │  EMBEDDING PROVIDER — pluggable, client-side first                  │
@@ -3657,6 +3681,149 @@ const TOOLS = [
       required: ['instance_id', 'context'],
     },
   },
+  // ── Layer 3: MADC ────────────────────────────────────────────────────────
+  {
+    name: 'madc_deliberate',
+    description:
+      'Multi-Agent Deliberation Chamber (MADC — Layer 3): When conflicting lessons exist for a topic, ' +
+      'run deliberation between 6 specialist expert agents (InfraAgent, AuthAgent, DeployAgent, DatabaseAgent, DebugAgent, APIAgent). ' +
+      'Each agent votes based on its domain CKG coverage. Unanimous vote → loser superseded. ' +
+      'Split vote → contested flag, causal_trace required before acting. ' +
+      'Resolution stored as permanent CKG node. Called automatically when learn_from_attempts detects a contradiction.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        instance_id: { type: 'string', description: 'Brain instance ID' },
+        topic: { type: 'string', description: 'Topic to deliberate, e.g. "fix:jwks-rotation"' },
+        context: { type: 'string', description: 'Optional context for the deliberation' },
+      },
+      required: ['instance_id', 'topic'],
+    },
+  },
+  // ── Layer 5: CLS ─────────────────────────────────────────────────────────
+  {
+    name: 'cls_ingest',
+    description:
+      'Continuous Learning Stream (CLS — Layer 5): Ingest learning signals WITHOUT explicit session_end calls. ' +
+      'Sources: git_commit (commit message + files → CKG edges), ci_outcome (green/red build → confirms fix), ' +
+      'ide_diagnostic (compiler error + fix pair → instant lesson). ' +
+      'Install automatic ingestion with cls_install_hooks — brain learns from every commit and CI run.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        instance_id: { type: 'string', description: 'Brain instance ID' },
+        source: {
+          type: 'string',
+          enum: ['git_commit', 'ci_outcome', 'ide_diagnostic'],
+          description: 'Event source type',
+        },
+        payload: {
+          type: 'object',
+          description:
+            'Event data. git_commit: {message, sha?, files?, diff?}. ' +
+            'ci_outcome: {status, prev_status, job, context?}. ' +
+            'ide_diagnostic: {error, fix, file?}',
+        },
+      },
+      required: ['instance_id', 'source', 'payload'],
+    },
+  },
+  {
+    name: 'cls_install_hooks',
+    description:
+      'Output a ready-to-install git post-commit hook + GitHub Actions step for Continuous Learning. ' +
+      'Once installed, every git commit and CI build automatically feeds the brain — no session_end needed. ' +
+      'Run once per repository.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        instance_id: { type: 'string', description: 'Brain instance ID' },
+        repo_path: { type: 'string', description: 'Path to repo root (default: current dir)' },
+        hooks: {
+          type: 'array',
+          items: { type: 'string', enum: ['git', 'ci'] },
+          description: 'Which hooks to output (default: ["git", "ci"])',
+        },
+      },
+      required: ['instance_id'],
+    },
+  },
+  // ── Layer 6: FedBrain ────────────────────────────────────────────────────
+  {
+    name: 'fedbrain_contribute',
+    description:
+      'FedBrain (Layer 6): Contribute a lesson to the global Knowledge Commons with a cryptographic ' +
+      'knowledge certificate. Certificate includes: domain fingerprint, confidence, outcome chain hash. ' +
+      'Lessons with 10+ independent confirmations become Gold Standard. Context-weighted: ' +
+      'other brains with similar tech stacks see your lesson ranked higher in fedbrain_search.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        instance_id: { type: 'string', description: 'Brain instance ID' },
+        lesson_key: { type: 'string', description: 'Topic key to contribute, e.g. "fix:clickhouse-ipv6"' },
+        visibility: {
+          type: 'string',
+          enum: ['public', 'org_private'],
+          description: 'Visibility (default: public)',
+        },
+      },
+      required: ['instance_id', 'lesson_key'],
+    },
+  },
+  {
+    name: 'fedbrain_search',
+    description:
+      'FedBrain context-weighted search: Search the global commons, weighting results by tech-stack similarity. ' +
+      'Brains with matching domain context (Go/Kubernetes/Postgres) rank higher than unrelated stacks. ' +
+      'Shows certificate provenance, confirm_count, and Gold Standard badges.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        instance_id: { type: 'string', description: 'Brain instance ID' },
+        query: { type: 'string', description: 'What to search for' },
+        context_hints: {
+          type: 'array',
+          items: { type: 'string' },
+          description: 'Your tech stack, e.g. ["go", "kubernetes", "postgres"]',
+        },
+        limit: { type: 'number', description: 'Max results (default: 10)' },
+      },
+      required: ['instance_id', 'query'],
+    },
+  },
+  {
+    name: 'fedbrain_confirm',
+    description:
+      'Confirm that a syndicated lesson from the global commons worked for you. ' +
+      'Propagates confirmation back — increments confirm_count on the knowledge certificate. ' +
+      'Also updates your local CKG confidence. At 10 independent confirmations → Gold Standard.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        instance_id: { type: 'string', description: 'Brain instance ID' },
+        topic: { type: 'string', description: 'Topic of the lesson to confirm' },
+        outcome: {
+          type: 'string',
+          enum: ['worked', 'partially_worked', 'did_not_work'],
+          description: 'Did the lesson work for you?',
+        },
+      },
+      required: ['instance_id', 'topic', 'outcome'],
+    },
+  },
+  {
+    name: 'fedbrain_status',
+    description:
+      'Show your FedBrain federation status: lessons contributed to global commons, recent confirmations, ' +
+      'Gold Standard lessons, pending propagations. Use to track your brain\'s global knowledge contribution.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        instance_id: { type: 'string', description: 'Brain instance ID' },
+      },
+      required: ['instance_id'],
+    },
+  },
 ] as const;
 
 // ── Handlers ──────────────────────────────────────────────────────────────────
@@ -3728,6 +3895,12 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
     ].join('\n');
   }
 
+  // Auto-resolve instance_id from env / API when not provided in args
+  if (!args.instance_id) {
+    const defaultId = await resolveDefaultInstanceId();
+    if (defaultId) args = { ...args, instance_id: defaultId };
+  }
+
   // Delegate v0.2 bulk/lock/stream tools first
   const bulkResult = await handleBulkLockStream(name, args);
   if (bulkResult !== null) return bulkResult;
@@ -4662,6 +4835,13 @@ async function handleTool(name: string, args: Record<string, unknown>): Promise<
           if (contradictionWarning.length > 0) {
             // Store contradiction audit but don't block
             auditTrail[auditTrail.length - 1].action = 'contradiction-resolved';
+            // Layer 3: Write CKG contradicts edge for MADC to process
+            try {
+              const cId = ckgSlug(topic);
+              const resId = ckgSlug(`resolution:${topic}`);
+              await ckgUpdateEdge(redis, cId, 'contradicts', resId, false);
+            } catch { /* non-critical */ }
+            contradictionWarning.push(`🗳️ Run \`madc_deliberate(topic="${topic}")\` to resolve via expert agent voting.`);
           }
         } catch { /* ignore parse error */ }
       } else {
@@ -8303,6 +8483,565 @@ smart_recall(
       return lines.join('\n');
     }
 
+    // ── Layer 3: MADC ─────────────────────────────────────────────────────────
+    case 'madc_deliberate': {
+      const { instance_id, topic } = args as { instance_id: string; topic: string };
+      const redis = await getConnection(instance_id);
+
+      const historyRaw = await redis.lrange(`cachly:lessons:${topic}`, 0, -1);
+      const history = historyRaw.map(r => { try { return JSON.parse(r) as { outcome: string; what_worked?: string; what_failed?: string; ts?: string }; } catch { return null; } }).filter(Boolean) as Array<{ outcome: string; what_worked?: string; what_failed?: string; ts?: string }>;
+
+      if (history.length < 2) {
+        return [
+          `🗳️ **MADC: "${topic}"**`, '',
+          `Not enough history for deliberation (need ≥ 2 entries, found ${history.length}).`,
+          '', `Call \`learn_from_attempts\` with conflicting outcomes to trigger deliberation.`,
+        ].join('\n');
+      }
+
+      // Specialist agents and their domain keywords
+      const AGENTS = [
+        { name: 'InfraAgent',    domains: ['infra', 'k8s', 'docker', 'server', 'wireguard', 'helm'] },
+        { name: 'AuthAgent',     domains: ['auth', 'jwt', 'keycloak', 'oauth', 'oidc', 'token'] },
+        { name: 'DeployAgent',   domains: ['deploy', 'ci', 'pipeline', 'rsync', 'release'] },
+        { name: 'DatabaseAgent', domains: ['db', 'gorm', 'migration', 'postgres', 'clickhouse', 'redis'] },
+        { name: 'DebugAgent',    domains: ['debug', 'panic', 'race', 'nil', 'fix', 'error'] },
+        { name: 'APIAgent',      domains: ['api', 'http', 'grpc', 'rest', 'fiber', 'web'] },
+      ];
+
+      const topicDomain = topic.split(':')[0] ?? '';
+      const relevantAgents = AGENTS.filter(a => a.domains.some(d => topicDomain === d || topic.includes(d)));
+      const votingAgents = relevantAgents.length > 0 ? relevantAgents : AGENTS;
+
+      // Measure each agent's CKG coverage in their domains
+      const agentCoverage = new Map<string, number>();
+      for (const agent of votingAgents) {
+        let edgeCount = 0;
+        for (const domain of agent.domains) {
+          const nodeKeys: string[] = [];
+          const nStream = redis.scanStream({ match: `cachly:ckg:node:${domain}*`, count: 50 });
+          await new Promise<void>((res, rej) => { nStream.on('data', (b: string[]) => nodeKeys.push(...b)); nStream.on('end', res); nStream.on('error', rej); });
+          edgeCount += nodeKeys.length;
+        }
+        agentCoverage.set(agent.name, edgeCount);
+      }
+
+      const successLessons = history.filter(l => l.outcome === 'success' || l.outcome === 'partial');
+      const failureLessons = history.filter(l => l.outcome === 'failure');
+
+      if (failureLessons.length === 0) {
+        return [
+          `🗳️ **MADC: "${topic}"**`, '',
+          `No contradictions found — all ${successLessons.length} entries have non-failure outcomes.`,
+          '', `Use \`ckg_inspect(concept="${ckgSlug(topic)}")\` to explore the confidence graph.`,
+        ].join('\n');
+      }
+
+      // Agent voting logic
+      const votes: Array<{ agent: string; vote: 'success' | 'failure' | 'abstain'; coverage: number; reason: string }> = [];
+      for (const agent of votingAgents) {
+        const coverage = agentCoverage.get(agent.name) ?? 0;
+        let vote: 'success' | 'failure' | 'abstain';
+        let reason: string;
+        if (coverage < 2) {
+          vote = 'abstain'; reason = 'insufficient domain coverage';
+        } else if (successLessons.length >= failureLessons.length * 2) {
+          vote = 'success'; reason = `${successLessons.length}/${history.length} entries confirm success`;
+        } else if (failureLessons.length >= successLessons.length * 2) {
+          vote = 'failure'; reason = `${failureLessons.length}/${history.length} entries confirm failure`;
+        } else {
+          vote = 'abstain'; reason = `contested (${successLessons.length} success vs ${failureLessons.length} failure)`;
+        }
+        votes.push({ agent: agent.name, vote, coverage, reason });
+      }
+
+      const successVotes = votes.filter(v => v.vote === 'success').length;
+      const failureVotes = votes.filter(v => v.vote === 'failure').length;
+      const abstainVotes = votes.filter(v => v.vote === 'abstain').length;
+
+      let resolution: 'unanimous_success' | 'unanimous_failure' | 'contested';
+      let resolutionText: string;
+      if (successVotes > 0 && failureVotes === 0) {
+        resolution = 'unanimous_success';
+        resolutionText = `✅ **Unanimous: SUCCESS** — ${successVotes} agent(s) confirm, ${abstainVotes} abstain`;
+      } else if (failureVotes > 0 && successVotes === 0) {
+        resolution = 'unanimous_failure';
+        resolutionText = `❌ **Unanimous: FAILURE** — ${failureVotes} agent(s) confirm, ${abstainVotes} abstain`;
+      } else {
+        resolution = 'contested';
+        resolutionText = `⚠️ **CONTESTED** — ${successVotes} success votes, ${failureVotes} failure votes, ${abstainVotes} abstain`;
+      }
+
+      // Store resolution as CKG node
+      const resNodeId = ckgSlug(`resolution:${topic}`);
+      const resNode = {
+        id: resNodeId, domain: 'resolution', type: 'resolution', count: 1,
+        ts: new Date().toISOString(), resolution, topic,
+        votes: { success: successVotes, failure: failureVotes, abstain: abstainVotes },
+      };
+      await redis.set(`cachly:ckg:node:${resNodeId}`, JSON.stringify(resNode));
+
+      // Write contradicts edge if contested
+      if (resolution === 'contested') {
+        await ckgUpdateEdge(redis, ckgSlug(topic), 'contradicts', resNodeId, false);
+      }
+
+      const lines = [
+        `🗳️ **MADC Deliberation: "${topic}"**`, '',
+        `📊 Evidence: ${successLessons.length} success/partial vs ${failureLessons.length} failure entries (${history.length} total)`,
+        '', `**Voting agents (${votingAgents.length}):**`,
+        ...votes.map(v => {
+          const icon = v.vote === 'success' ? '✅' : v.vote === 'failure' ? '❌' : '⬜';
+          const covBar = '▓'.repeat(Math.min(v.coverage, 5)) + '░'.repeat(Math.max(0, 5 - v.coverage));
+          return `  ${icon} **${v.agent}** [${covBar}] ${v.coverage} CKG edges — ${v.reason}`;
+        }),
+        '', resolutionText, '',
+      ];
+
+      if (resolution === 'unanimous_success') {
+        lines.push(`🔧 Failure entries superseded — store confirmed lesson: \`learn_from_attempts(topic="${topic}", outcome="success", ...)\``);
+      } else if (resolution === 'unanimous_failure') {
+        lines.push(`🚫 Success claims unconfirmed — re-verify: \`recall_best_solution(topic="${topic}")\``);
+      } else {
+        lines.push(`⚠️ Contested — run \`causal_trace\` before acting. Explore: \`ckg_inspect(concept="${ckgSlug(topic)}")\``);
+      }
+
+      lines.push('', `📝 Resolution node: \`cachly:ckg:node:${resNodeId}\``);
+      return lines.join('\n');
+    }
+
+    // ── Layer 5: CLS — cls_ingest ─────────────────────────────────────────────
+    case 'cls_ingest': {
+      const { instance_id, source, payload } = args as {
+        instance_id: string;
+        source: 'git_commit' | 'ci_outcome' | 'ide_diagnostic';
+        payload: Record<string, unknown>;
+      };
+      const redis = await getConnection(instance_id);
+      const ts = new Date().toISOString();
+      const clsKey = 'cachly:cls:events';
+
+      if (source === 'git_commit') {
+        const message = String(payload.message ?? '');
+        const sha = String(payload.sha ?? '');
+        const files = (Array.isArray(payload.files) ? payload.files : []) as string[];
+
+        const domain = /^fix/i.test(message) ? 'fix' : /^feat/i.test(message) ? 'feat' : /^refactor/i.test(message) ? 'refactor' : /^test/i.test(message) ? 'test' : 'commit';
+        const slug = `${domain}:${ckgSlug(message.slice(0, 60))}`;
+        const conceptId = ckgSlug(slug);
+
+        await ckgUpsertNode(redis, conceptId, domain, 'commit');
+        for (const f of files.slice(0, 10)) {
+          const fd = f.includes('auth') ? 'auth' : f.includes('api') ? 'api' : f.includes('infra') ? 'infra' : f.includes('web') ? 'web' : 'code';
+          const fileId = ckgSlug(`file:${fd}`);
+          await ckgUpsertNode(redis, fileId, 'file', fd);
+          await ckgUpdateEdge(redis, conceptId, 'co-occurs', fileId, true);
+        }
+
+        const lessonObj = {
+          topic: slug, outcome: 'success' as const, what_worked: message, what_failed: '',
+          context: `CLS/git: sha=${sha}`, severity: 'minor' as const,
+          file_paths: files.slice(0, 10), commands: sha ? [`git show ${sha}`] : [],
+          tags: ['cls', 'git'], depends_on: [], recall_count: 0, ts, verified_at: ts,
+          confidence: 0.6, audit_trail: [{ ts, action: 'cls_git_commit' }], version: 3,
+        };
+        await redis.rpush(`cachly:lessons:${slug}`, JSON.stringify(lessonObj));
+        const existing = await redis.get(`cachly:lesson:best:${slug}`);
+        if (!existing) await redis.set(`cachly:lesson:best:${slug}`, JSON.stringify(lessonObj));
+
+        await redis.rpush(clsKey, JSON.stringify({ source, payload: { message, sha }, ts }));
+        await redis.ltrim(clsKey, -200, -1);
+
+        return [
+          `📨 **CLS Ingested: git_commit**`, '',
+          `Commit \`${sha.slice(0, 8) || '?'}\`: ${message.slice(0, 80)}`,
+          `Concept: \`${conceptId}\` (${domain}) · Files: ${files.length}`,
+          '', `🕸️ CKG: \`${conceptId}\` + ${files.length} file edges · Lesson: \`${slug}\``,
+          `💡 Inspect: \`ckg_inspect(concept="${domain}")\``,
+        ].join('\n');
+      }
+
+      if (source === 'ci_outcome') {
+        const status = String(payload.status ?? '');
+        const prev_status = String(payload.prev_status ?? '');
+        const job = String(payload.job ?? 'unknown');
+        const ciCtx = String(payload.context ?? '');
+
+        const isFixed = ['failure', 'red', 'error'].includes(prev_status) && ['success', 'green', 'passed'].includes(status);
+        const isBroken = ['success', 'green', 'passed'].includes(prev_status) && ['failure', 'red', 'error'].includes(status);
+
+        const slug = `ci:${ckgSlug(job)}`;
+        const conceptId = ckgSlug(slug);
+        await ckgUpsertNode(redis, conceptId, 'ci', 'job');
+
+        if (isFixed) {
+          const problemId = ckgSlug(`problem:${ckgSlug(job)}`);
+          await ckgUpsertNode(redis, problemId, 'problem', 'ci-failure');
+          await ckgUpdateEdge(redis, conceptId, 'fixes', problemId, true);
+          const lessonObj = {
+            topic: slug, outcome: 'success' as const,
+            what_worked: `CI job "${job}" went ${prev_status} → ${status}`,
+            what_failed: `Job "${job}" was failing`, context: `CLS/ci: ${ciCtx}`,
+            severity: 'major' as const, file_paths: [], commands: [], tags: ['cls', 'ci'],
+            depends_on: [], recall_count: 0, ts, verified_at: ts, confidence: 0.75,
+            audit_trail: [{ ts, action: 'cls_ci_fixed' }], version: 3,
+          };
+          await redis.rpush(`cachly:lessons:${slug}`, JSON.stringify(lessonObj));
+          await redis.set(`cachly:lesson:best:${slug}`, JSON.stringify(lessonObj));
+        } else if (isBroken) {
+          const causeId = ckgSlug(`cause:${ckgSlug(job)}`);
+          await ckgUpsertNode(redis, causeId, 'cause', 'ci-break');
+          await ckgUpdateEdge(redis, conceptId, 'causes', causeId, false);
+        }
+
+        await redis.rpush(clsKey, JSON.stringify({ source, payload: { status, prev_status, job }, ts }));
+        await redis.ltrim(clsKey, -200, -1);
+
+        const statusIcon = isFixed ? '✅ Fixed' : isBroken ? '🔴 Broken' : '📊 Recorded';
+        return [
+          `📨 **CLS Ingested: ci_outcome**`, '',
+          `${statusIcon}: \`${job}\` — ${prev_status || '?'} → ${status}`,
+          isFixed ? `🔧 CKG \`fixes\` edge added (75% confidence)` : isBroken ? `⚡ CKG \`causes\` edge added` : `📊 State recorded`,
+          `💡 Lesson: \`${slug}\`  |  Predict: \`brain_predict(context="${job}")\``,
+        ].join('\n');
+      }
+
+      if (source === 'ide_diagnostic') {
+        const error = String(payload.error ?? '');
+        const fix = String(payload.fix ?? '');
+        const file = String(payload.file ?? '');
+
+        const errorConcept = extractProblemConcept(error) ?? 'unknown-error';
+        const slug = `debug:${ckgSlug(errorConcept)}`;
+        const conceptId = ckgSlug(slug);
+        const problemId = ckgSlug(`problem:${errorConcept}`);
+
+        await ckgUpsertNode(redis, conceptId, 'debug', 'diagnostic');
+        await ckgUpsertNode(redis, problemId, 'problem', 'compiler-error');
+        await ckgUpdateEdge(redis, conceptId, 'fixes', problemId, true);
+
+        const lessonObj = {
+          topic: slug, outcome: 'success' as const, what_worked: fix, what_failed: error,
+          context: `CLS/ide: ${file}`, severity: 'minor' as const,
+          file_paths: file ? [file] : [], commands: [], tags: ['cls', 'ide-diagnostic'],
+          depends_on: [], recall_count: 0, ts, verified_at: ts, confidence: 0.65,
+          audit_trail: [{ ts, action: 'cls_ide_diagnostic' }], version: 3,
+        };
+        await redis.rpush(`cachly:lessons:${slug}`, JSON.stringify(lessonObj));
+        const existingL = await redis.get(`cachly:lesson:best:${slug}`);
+        if (!existingL) await redis.set(`cachly:lesson:best:${slug}`, JSON.stringify(lessonObj));
+
+        await redis.rpush(clsKey, JSON.stringify({ source, payload: { error: error.slice(0, 60), fix: fix.slice(0, 60), file }, ts }));
+        await redis.ltrim(clsKey, -200, -1);
+
+        return [
+          `📨 **CLS Ingested: ide_diagnostic**`, '',
+          `Error: \`${error.slice(0, 80)}\``,
+          `Fix: ${fix.slice(0, 100)}`,
+          file ? `File: \`${file}\`` : '',
+          '', `🕸️ CKG: \`${conceptId}\` → fixes → \`${problemId}\`  |  Lesson: \`${slug}\``,
+        ].filter(l => l !== '').join('\n');
+      }
+
+      return `❌ Unknown CLS source: "${source}". Valid: git_commit, ci_outcome, ide_diagnostic`;
+    }
+
+    // ── Layer 5: CLS — cls_install_hooks ─────────────────────────────────────
+    case 'cls_install_hooks': {
+      const { instance_id, repo_path = '.', hooks = ['git', 'ci'] } = args as {
+        instance_id: string; repo_path?: string; hooks?: string[];
+      };
+      const hooksArr = Array.isArray(hooks) ? hooks : ['git', 'ci'];
+      const lines: string[] = [`🔌 **CLS Hook Installation Guide**\n`];
+
+      if (hooksArr.includes('git')) {
+        const hookScript = [
+          `#!/bin/sh`,
+          `# cachly CLS — Continuous Learning Stream git hook`,
+          `# Installed by cls_install_hooks · runs silently on every commit`,
+          `INSTANCE="${instance_id}"`,
+          `SHA=$(git rev-parse HEAD 2>/dev/null || echo "")`,
+          `MSG=$(git log -1 --pretty=%B 2>/dev/null | head -1)`,
+          `FILES=$(git diff-tree --no-commit-id -r --name-only HEAD 2>/dev/null | tr '\\n' ',' | sed 's/,$//')`,
+          `node -e "`,
+          `const p={instance_id:'$INSTANCE',source:'git_commit',payload:{message:$(echo "$MSG" | jq -R . 2>/dev/null || echo '"commit"'),sha:'$SHA',files:'$FILES'.split(',').filter(Boolean)}};`,
+          `try{require('child_process').execSync('npx @cachly-dev/mcp-server@latest cls-ingest \\''+JSON.stringify(p)+'\\'',{stdio:'ignore',timeout:5000})}catch(e){}`,
+          `" 2>/dev/null &`,
+          `exit 0`,
+        ].join('\n');
+
+        lines.push(`### Git post-commit hook`);
+        lines.push(`**Quick install (run once per repo):**`);
+        lines.push('```sh');
+        lines.push(`cat > ${repo_path}/.git/hooks/post-commit << 'HOOK'`);
+        lines.push(hookScript);
+        lines.push(`HOOK`);
+        lines.push(`chmod +x ${repo_path}/.git/hooks/post-commit`);
+        lines.push('```');
+        lines.push(`After install: every \`git commit\` automatically updates your brain's CKG.`);
+        lines.push('');
+      }
+
+      if (hooksArr.includes('ci')) {
+        lines.push(`### GitHub Actions CI outcome hook`);
+        lines.push(`**Add at the end of each job** (after build/test steps):`);
+        lines.push('```yaml');
+        lines.push(`- name: cachly CLS — record CI outcome`);
+        lines.push(`  if: always()`);
+        lines.push(`  run: |`);
+        lines.push(`    node -e "`);
+        lines.push(`    const r=require('https');`);
+        lines.push(`    const d=JSON.stringify({instance_id:'${instance_id}',source:'ci_outcome',payload:{`);
+        lines.push(`      status:'\${{ job.status }}',prev_status:'unknown',job:'\${{ github.job }}',`);
+        lines.push(`      context:'github-actions run \${{ github.run_number }}'}});`);
+        lines.push(`    r.request({hostname:'api.cachly.dev',path:'/api/v1/cls/ingest',method:'POST',`);
+        lines.push(`      headers:{'Content-Type':'application/json','Authorization':'Bearer \$CACHLY_JWT',`);
+        lines.push(`        'Content-Length':d.length}},()=>{}).end(d);`);
+        lines.push(`    " 2>/dev/null || true`);
+        lines.push(`  env:`);
+        lines.push(`    CACHLY_JWT: \${{ secrets.CACHLY_JWT }}`);
+        lines.push('```');
+        lines.push('');
+      }
+
+      lines.push(`💡 Once installed: \`brain_search(query="cls")\` to verify events are arriving.`);
+      lines.push(`📊 Monitor CKG growth: \`ckg_inspect(concept="ci")\` or \`ckg_inspect(concept="fix")\``);
+      return lines.join('\n');
+    }
+
+    // ── Layer 6: FedBrain — fedbrain_contribute ───────────────────────────────
+    case 'fedbrain_contribute': {
+      const { instance_id, lesson_key, visibility = 'public' } = args as {
+        instance_id: string; lesson_key: string; visibility?: string;
+      };
+      const redis = await getConnection(instance_id);
+
+      const raw = await redis.get(`cachly:lesson:best:${lesson_key}`);
+      if (!raw) return `❌ Lesson \`${lesson_key}\` not found. Store it first with \`learn_from_attempts\`.`;
+
+      const lesson = JSON.parse(raw) as { topic: string; outcome: string; what_worked: string; what_failed?: string; tags?: string[]; commands?: string[]; severity?: string; ts?: string };
+
+      const domainTokens = [lesson.topic.split(':')[0], ...(lesson.tags ?? [])].filter(Boolean);
+      const domainFingerprint = [...new Set(domainTokens)].sort().join(',');
+
+      // HMAC certificate ID (non-reversible, privacy-safe)
+      const certContent = `${lesson.topic}:${lesson.outcome}:${lesson.what_worked}`;
+      const certId = createHmac('sha256', `cachly-fedbrain:${instance_id}`).update(certContent).digest('hex').slice(0, 16);
+
+      const cert = {
+        cert_id: certId, lesson_key, visibility,
+        domain_fingerprint: domainFingerprint,
+        contributed_at: new Date().toISOString(),
+        confirm_count: 0,
+        trust_score: lesson.outcome === 'success' ? 0.85 : 0.5,
+      };
+      await redis.set(`cachly:fedbrain:cert:${certId}`, JSON.stringify(cert));
+      await redis.sadd('cachly:fedbrain:contributed', certId);
+
+      // Try global commons via syndication API
+      let syndicationResult: string;
+      try {
+        await apiFetch('/api/v1/syndication/contribute', {
+          method: 'POST',
+          body: JSON.stringify({
+            topic: lesson.topic, outcome: lesson.outcome,
+            what_worked: lesson.what_worked, what_failed: lesson.what_failed ?? '',
+            severity: lesson.severity ?? 'major', cert_id: certId,
+            domain_fingerprint: domainFingerprint, visibility,
+          }),
+        });
+        syndicationResult = `✅ Contributed to global commons`;
+      } catch {
+        syndicationResult = `📦 Stored locally (commons API unavailable — will sync when online)`;
+      }
+
+      return [
+        `🌐 **FedBrain Contribute: "${lesson_key}"**`, '',
+        `📜 Certificate: \`${certId}\``,
+        `🏷️ Domain fingerprint: ${domainTokens.slice(0, 6).map(t => `\`${t}\``).join(', ')}`,
+        `🔒 Visibility: ${visibility}`,
+        '', syndicationResult, '',
+        `💡 At 10 independent confirms → 🏆 Gold Standard`,
+        `🔍 Search: \`fedbrain_search(query="${lesson.topic.split(':').slice(-1)[0]}")\``,
+      ].join('\n');
+    }
+
+    // ── Layer 6: FedBrain — fedbrain_search ──────────────────────────────────
+    case 'fedbrain_search': {
+      const { instance_id, query, context_hints = [], limit = 10 } = args as {
+        instance_id: string; query: string; context_hints?: string[]; limit?: number;
+      };
+      const redis = await getConnection(instance_id);
+
+      // Build local domain context from contributed certificates + explicit hints
+      const contribIds = await redis.smembers('cachly:fedbrain:contributed');
+      const localDomains = new Map<string, number>();
+      for (const certId of contribIds.slice(0, 30)) {
+        const certRaw = await redis.get(`cachly:fedbrain:cert:${certId}`);
+        if (!certRaw) continue;
+        try {
+          const cert = JSON.parse(certRaw) as { domain_fingerprint?: string };
+          for (const d of (cert.domain_fingerprint ?? '').split(',').filter(Boolean)) {
+            localDomains.set(d, (localDomains.get(d) ?? 0) + 1);
+          }
+        } catch { /* skip */ }
+      }
+      for (const hint of (Array.isArray(context_hints) ? context_hints : [])) {
+        localDomains.set(hint.toLowerCase(), (localDomains.get(hint.toLowerCase()) ?? 0) + 2);
+      }
+
+      // Search global commons
+      type SynResult = { id: string; topic: string; category: string; outcome: string; what_worked: string; what_failed?: string; severity: string; confirm_count: number; created_at: string; domain_fingerprint?: string };
+      let results: SynResult[] = [];
+      try {
+        const params = new URLSearchParams({ q: query, limit: String(Math.min((limit as number) * 2, 50)) });
+        const res = await apiFetch<{ results: SynResult[]; count: number }>(`/api/v1/syndication/search?${params}`);
+        results = res.results ?? [];
+      } catch {
+        // Fallback: search local lessons
+        const lessonKeys: string[] = [];
+        const lStream = redis.scanStream({ match: 'cachly:lesson:best:*', count: 200 });
+        await new Promise<void>((res, rej) => { lStream.on('data', (b: string[]) => lessonKeys.push(...b)); lStream.on('end', res); lStream.on('error', rej); });
+        for (const k of lessonKeys.slice(0, 60)) {
+          const r = await redis.get(k);
+          if (!r) continue;
+          try {
+            const l = JSON.parse(r) as { topic: string; outcome: string; what_worked?: string; what_failed?: string; severity?: string; ts?: string };
+            const haystack = `${l.topic} ${l.what_worked ?? ''} ${l.what_failed ?? ''}`.toLowerCase();
+            if (query.toLowerCase().split(/\s+/).some(t => t.length > 2 && haystack.includes(t))) {
+              results.push({ id: k.split(':').pop() ?? k, topic: l.topic, category: l.topic.split(':')[0], outcome: l.outcome, what_worked: l.what_worked ?? '', severity: l.severity ?? 'major', confirm_count: 0, created_at: l.ts ?? new Date().toISOString() });
+            }
+          } catch { /* skip */ }
+        }
+      }
+
+      if (results.length === 0) {
+        return [`🌐 **FedBrain Search: "${query}"**`, '', `No results. Contribute: \`fedbrain_contribute(lesson_key="fix:...")\``].join('\n');
+      }
+
+      // Context-weighted ranking
+      const ranked = results.map(r => {
+        const rDomains = (r.domain_fingerprint ?? r.category ?? '').split(',').filter(Boolean);
+        const overlap = rDomains.reduce((s, d) => s + (localDomains.get(d) ?? 0), 0);
+        const contextScore = localDomains.size > 0 ? overlap / Math.max(1, localDomains.size + rDomains.length) : 0;
+        const confirmedScore = Math.min(1, r.confirm_count / 10);
+        const weightedScore = (contextScore * 0.4) + (confirmedScore * 0.4) + (r.outcome === 'success' ? 0.2 : 0);
+        return { ...r, weightedScore, isGoldStandard: r.confirm_count >= 10 };
+      }).sort((a, b) => b.weightedScore - a.weightedScore).slice(0, limit as number);
+
+      const lines = [`🌐 **FedBrain Search: "${query}"** — ${ranked.length} result${ranked.length !== 1 ? 's' : ''} (context-weighted)\n`];
+      for (const r of ranked) {
+        const icon = r.outcome === 'success' ? '✅' : r.outcome === 'failure' ? '❌' : '⚠️';
+        const goldBadge = r.isGoldStandard ? ' 🏆 _Gold Standard_' : r.confirm_count >= 3 ? ` ✓${r.confirm_count}` : '';
+        const ctxPct = Math.round(r.weightedScore * 100);
+        lines.push(`${icon}${goldBadge} **\`${r.topic}\`** [ctx: ${ctxPct}%]`);
+        if (r.what_worked) lines.push(`  ✅ ${r.what_worked.slice(0, 150)}`);
+        if (r.what_failed) lines.push(`  ❌ ${r.what_failed.slice(0, 80)}`);
+        lines.push(`  _${r.confirm_count} confirm${r.confirm_count !== 1 ? 's' : ''}  |  \`${r.id.slice(0, 12)}\`_`, '');
+      }
+      if (localDomains.size > 0) {
+        const topDomains = [...localDomains.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5).map(([d, n]) => `\`${d}\`(${n})`).join(', ');
+        lines.push(`🎯 Your context: ${topDomains}`);
+      }
+      lines.push(`💡 Confirm: \`fedbrain_confirm(topic="<topic>", outcome="worked")\``);
+      return lines.join('\n');
+    }
+
+    // ── Layer 6: FedBrain — fedbrain_confirm ─────────────────────────────────
+    case 'fedbrain_confirm': {
+      const { instance_id, topic, outcome } = args as {
+        instance_id: string; topic: string; outcome: 'worked' | 'partially_worked' | 'did_not_work';
+      };
+      const redis = await getConnection(instance_id);
+      const ts = new Date().toISOString();
+
+      const confirmEntry = JSON.stringify({ topic, outcome, ts });
+      await redis.rpush('cachly:fedbrain:confirmations', confirmEntry);
+      await redis.ltrim('cachly:fedbrain:confirmations', -200, -1);
+
+      // Update local CKG confidence
+      const worked = outcome === 'worked';
+      const partial = outcome === 'partially_worked';
+      await ckgUpdateEdge(redis, ckgSlug(topic), 'fixes', ckgSlug(`syndicated:${topic}`), worked, partial);
+
+      // Propagate to global commons
+      let propResult: string;
+      try {
+        await apiFetch('/api/v1/syndication/confirm', { method: 'POST', body: JSON.stringify({ topic, outcome }) });
+        propResult = `✅ Confirmation propagated to global commons`;
+      } catch {
+        await redis.rpush('cachly:fedbrain:pending_confirms', confirmEntry);
+        await redis.ltrim('cachly:fedbrain:pending_confirms', -50, -1);
+        propResult = `📦 Queued locally (API unavailable — will propagate on next online session)`;
+      }
+
+      const icon = worked ? '✅' : partial ? '⚠️' : '❌';
+      return [
+        `${icon} **FedBrain Confirm: "${topic}"** → ${outcome}`, '',
+        propResult, '',
+        `🕸️ CKG confidence ${worked || partial ? 'boosted' : 'reduced'} for \`${ckgSlug(topic)}\``,
+        `💡 Your confirmation helps other brains worldwide.`,
+        `📊 Status: \`fedbrain_status(instance_id="...")\``,
+      ].join('\n');
+    }
+
+    // ── Layer 6: FedBrain — fedbrain_status ──────────────────────────────────
+    case 'fedbrain_status': {
+      const { instance_id } = args as { instance_id: string };
+      const redis = await getConnection(instance_id);
+
+      const contribIds = await redis.smembers('cachly:fedbrain:contributed');
+      const confirmsRaw = await redis.lrange('cachly:fedbrain:confirmations', -10, -1);
+      const pendingConfirms = await redis.llen('cachly:fedbrain:pending_confirms');
+      const confirms = confirmsRaw.map(r => { try { return JSON.parse(r) as { topic: string; outcome: string; ts: string }; } catch { return null; } }).filter(Boolean) as Array<{ topic: string; outcome: string; ts: string }>;
+
+      const certDetails: Array<{ cert_id: string; lesson_key: string; confirm_count: number; trust_score: number; isGold: boolean }> = [];
+      for (const certId of contribIds.slice(0, 15)) {
+        const raw = await redis.get(`cachly:fedbrain:cert:${certId}`);
+        if (!raw) continue;
+        try {
+          const cert = JSON.parse(raw) as { cert_id: string; lesson_key: string; confirm_count?: number; trust_score?: number };
+          certDetails.push({ cert_id: cert.cert_id, lesson_key: cert.lesson_key, confirm_count: cert.confirm_count ?? 0, trust_score: cert.trust_score ?? 0.5, isGold: (cert.confirm_count ?? 0) >= 10 });
+        } catch { /* skip */ }
+      }
+
+      const lines = [
+        `🌐 **FedBrain Status**\n`,
+        `### 📤 Contributed Lessons: ${contribIds.length}`,
+      ];
+
+      if (certDetails.length > 0) {
+        for (const c of certDetails) {
+          const goldBadge = c.isGold ? ' 🏆 Gold Standard' : '';
+          const confBar = '█'.repeat(Math.min(10, c.confirm_count)) + '░'.repeat(Math.max(0, 10 - c.confirm_count));
+          lines.push(`  \`${c.lesson_key}\` [${confBar}] ×${c.confirm_count}${goldBadge}`);
+        }
+      } else {
+        lines.push(`  _None yet. Contribute with \`fedbrain_contribute(lesson_key="fix:...")\`_`);
+      }
+
+      lines.push('', `### 📥 Recent Confirmations: ${confirms.length}`);
+      if (confirms.length > 0) {
+        for (const c of confirms.slice(-5)) {
+          const icon = c.outcome === 'worked' ? '✅' : c.outcome === 'partially_worked' ? '⚠️' : '❌';
+          lines.push(`  ${icon} \`${c.topic}\` — ${c.outcome} (${new Date(c.ts).toLocaleDateString('de-DE')})`);
+        }
+      } else {
+        lines.push(`  _None yet. Confirm syndicated lessons with \`fedbrain_confirm\`_`);
+      }
+
+      if (pendingConfirms > 0) {
+        lines.push('', `⚠️ ${pendingConfirms} confirmation${pendingConfirms !== 1 ? 's' : ''} pending propagation`);
+      }
+
+      lines.push('', '---',
+        `**Contribute:** \`fedbrain_contribute(lesson_key="fix:...")\``,
+        `**Search:** \`fedbrain_search(query="...")\``,
+        `**Confirm:** \`fedbrain_confirm(topic="...", outcome="worked")\``,
+      );
+      return lines.join('\n');
+    }
+
     default:
       return null;
   }