@davesheffer/hunch 0.14.2 → 0.15.0

package/README.md

@@ -258,6 +258,33 @@ or a blocking-linked regression — near-hits stay advisory, so it's safe as a m
 it before opening a PR (`{}` checks staged changes; pass `base: "origin/main"` for the range);
 the CI Constraint Guard renders the same cited verdict as a PR comment.
 
+## Veto: re-introducing a *rejected* approach is blocked
+
+The Regression Guard catches re-adding code a decision deliberately **retired**. But the most
+expensive reversal is re-introducing an approach a decision **rejected** — the
+`alternatives_rejected` that *never existed in code*, so a diff-only reviewer (and the regression
+guard) is blind to it. A fresh session, not knowing, re-adds the very dependency you rejected for
+latency last month.
+
+**Veto** closes that gap. A decision can carry **tripwires** — machine-checkable signals (a
+forbidden dependency, symbol, or scoped pattern) for an `alternatives_rejected` entry. When a diff
+re-introduces one, Hunch blocks it with the receipt:
+
+```text
+⛔ VETO — this reverses dec_49916d02c9 ("Read-only layer over committed .hunch/ JSON").
+   You rejected: "extension queries MCP/API server for data" (adds latency, runtime coupling)
+   You chose:    read directly from committed JSON, no backend dependency.
+   evidence: +import axios   (vscode-extension/src/extension.ts)
+```
+
+It rides the **same rails** as everything else: `CheckReport.vetoes` lights up `hunch check`, the CI
+guard, and `hunch_merge_verdict` together, and the pre-edit hook denies the live edit (Edit / Write /
+MultiEdit) *before* it's staged — so the agent self-corrects with no human in the loop. Enforcement
+is **deterministic** (a set-intersection over a human-vouched record — no model in the block path)
+and **progressive**: an auto-drafted tripwire only *warns*; `hunch veto backfill` drafts them and
+`hunch review --accept` confirms a decision **and** its tripwires, flipping it from advisory to
+blocking in one keypress. Full design + DX: [docs/veto.md](docs/veto.md).
+
 ## Semantic search (optional)
 
 By default `hunch query` and the `hunch_query` MCP tool use fast keyword (FTS) search —

package/dist/cli/index.js

@@ -37,7 +37,8 @@ import { scaffoldProviders } from "../integrations/providers.js";
 import { healClaudeConfigCaseSplit } from "../integrations/claudeConfig.js";
 import { formatContext } from "../core/format.js";
 import { readConfig, writeConfig, FIRMNESS_LEVELS, isFirmness } from "../core/config.js";
-import { blockingInScope } from "../core/hookpolicy.js";
+import { blockingInScope, vetoInScope, proposedEditLines } from "../core/hookpolicy.js";
+import { draftTripwires, knownRepoDeps } from "../synthesis/tripwires.js";
 import { constraintId } from "../core/ids.js";
 import { readManifest, writeManifest, SCHEMA_VERSION } from "../core/migrate.js";
 import { mergeHunchJson } from "../store/merge.js";
@@ -555,7 +556,7 @@ program
     if (sources.length > 1)
         return fail(`pick one of --staged / --commit / --base (got ${sources.join(", ")})`);
     const markdown = opts.format === "markdown";
-    const emptyReport = { fileCount: 0, strict: !!opts.strict, direct: [], near: [], regressions: [], strictBlockers: 0, regBlocking: 0 };
+    const emptyReport = { fileCount: 0, strict: !!opts.strict, direct: [], near: [], regressions: [], vetoes: [], strictBlockers: 0, regBlocking: 0, vetoBlocking: 0 };
     const { store, root } = storeFor();
     // Fail loudly on an unresolvable --base (e.g. CI forgot to fetch the base
     // branch) — otherwise the diff is empty and the guard passes vacuously.
@@ -594,6 +595,80 @@ program
         process.exitCode = 1;
     store.close();
 });
+// ---- veto (the rejected-alternative class, in isolation) ------------------
+const vetoCmd = program
+    .command("veto")
+    .description("Decision Guard: flag changes that REVERSE a decision — re-introducing an approach an in-force decision rejected (the rejected-alternatives class, on its own).")
+    .option("--staged", "check git staged files (default)")
+    .option("--commit <sha>", "check a specific commit's files")
+    .option("--base <ref>", "check a PR/branch: files changed vs <ref> (e.g. origin/main)")
+    .option("--strict", "exit non-zero on a human-confirmed, in-force, non-stale veto")
+    .option("--format <fmt>", "output: text (default) | markdown", "text")
+    .action((opts) => {
+    const sources = [opts.commit && "--commit", opts.base && "--base", opts.staged && "--staged"].filter(Boolean);
+    if (sources.length > 1)
+        return fail(`pick one of --staged / --commit / --base (got ${sources.join(", ")})`);
+    const markdown = opts.format === "markdown";
+    const { store, root } = storeFor();
+    if (opts.base && !revExists(opts.base, root)) {
+        store.close();
+        return fail(`--base ref "${opts.base}" does not resolve. In CI, fetch the base branch first (git fetch origin <branch>).`);
+    }
+    store.reindex();
+    const files = opts.commit ? commitFiles(opts.commit, root)
+        : opts.base ? rangeFiles(opts.base, root)
+            : stagedFiles(root);
+    if (!files.length) {
+        console.log("No changed files to check.");
+        store.close();
+        return;
+    }
+    const diff = opts.commit ? commitDiff(opts.commit, root) : opts.base ? rangeDiff(opts.base, root) : stagedDiff(root);
+    const full = store.buildCheckReport(files, diff, { strict: !!opts.strict, lastChange: (f) => lastChangeDate(f, root) });
+    if (!full.vetoes.length) {
+        console.log(`✓ ${files.length} changed file(s) reverse no decision you rejected.`);
+        store.close();
+        return;
+    }
+    // Render ONLY the veto class — zero the other sections so the shared renderer
+    // shows just the rejected-alternative reversals (the rest is `hunch check`).
+    const vetoOnly = { ...full, direct: [], near: [], regressions: [], strictBlockers: 0, regBlocking: 0 };
+    console.log(markdown ? renderMarkdown(vetoOnly) : renderText(vetoOnly));
+    if (reportFailsStrict(vetoOnly))
+        process.exitCode = 1;
+    store.close();
+});
+vetoCmd
+    .command("backfill")
+    .description("Draft machine-checkable tripwires for existing rejected alternatives. Drafts are ADVISORY — confirm with `hunch review --accept <id>` to enable blocking.")
+    .action(() => {
+    const { store, root } = storeFor();
+    const knownDeps = knownRepoDeps(root);
+    let drafted = 0;
+    let touched = 0;
+    for (const d of store.json.loadAll("decisions")) {
+        if (d.superseded_by || d.status === "superseded")
+            continue;
+        if (!d.alternatives_rejected.length)
+            continue;
+        if ((d.rejected_tripwires?.length ?? 0) > 0)
+            continue; // never clobber existing tripwires
+        const tws = draftTripwires(d.alternatives_rejected, d.related_files, knownDeps);
+        store.json.put("decisions", { ...d, rejected_tripwires: tws });
+        drafted += tws.length;
+        touched++;
+    }
+    store.reindex();
+    if (!touched) {
+        console.log("✓ Nothing to backfill — every in-force decision with rejected alternatives already has tripwires.");
+    }
+    else {
+        console.log(`✓ Drafted ${drafted} tripwire(s) across ${touched} decision(s) — all ADVISORY (llm_draft).`);
+        console.log("  They warn but never block until confirmed. Confirm a decision's tripwires:");
+        console.log("  hunch review --accept <decision-id>");
+    }
+    store.close();
+});
 // ---- ci (scaffold the CI Constraint Guard) --------------------------------
 program
     .command("ci")
@@ -736,6 +811,16 @@ program
                 emitDeny(deny.reason);
                 return;
             }
+            // Veto Guard (live): the proposed edit text re-introduces an approach an
+            // in-force decision REJECTED. Covers Edit (new_string), Write (content), and
+            // MultiEdit (edits[].new_string). The agent self-corrects before staging;
+            // only human-confirmed tripwires deny.
+            const proposedLines = proposedEditLines(evt.tool_input);
+            const vetoDeny = proposedLines.length ? vetoInScope(store, target, proposedLines) : null;
+            if (vetoDeny) {
+                emitDeny(vetoDeny.reason);
+                return;
+            }
         }
         // advisory / firm / strict(non-blocking): inject the relevant Hunch slice.
         const ctx = store.assembleContext(target);
@@ -777,10 +862,27 @@ program
         if (!d)
             return fail(`decision ${opts.accept} not found`);
         const source = d.provenance.source.includes("llm_draft") ? "llm_draft+human_confirmed" : "human_confirmed";
-        store.json.put("decisions", { ...d, status: "accepted", provenance: { ...d.provenance, source, confidence: 0.95, last_verified: new Date().toISOString() } });
+        const now = new Date().toISOString();
+        // Accepting a decision also CONFIRMS its drafted tripwires — this is how the
+        // Veto Guard goes from advisory to blocking ("confirm rides hunch review").
+        const tws = d.rejected_tripwires ?? [];
+        const confirmedTws = tws.map((tw) => ({
+            ...tw,
+            provenance: {
+                ...tw.provenance,
+                source: tw.provenance.source.includes("human_confirmed")
+                    ? tw.provenance.source
+                    : tw.provenance.source.includes("llm_draft")
+                        ? "llm_draft+human_confirmed"
+                        : "human_confirmed",
+                last_verified: now,
+            },
+        }));
+        store.json.put("decisions", { ...d, status: "accepted", rejected_tripwires: confirmedTws, provenance: { ...d.provenance, source, confidence: 0.95, last_verified: now } });
         store.reindex();
         updateClaudeMd(root, store);
-        console.log(`✓ accepted ${opts.accept} (now ${source}, confidence 0.95)`);
+        const twNote = confirmedTws.length ? `, ${confirmedTws.length} tripwire(s) now blocking` : "";
+        console.log(`✓ accepted ${opts.accept} (now ${source}, confidence 0.95${twNote})`);
     }
     else if (opts.reject) {
         const ok2 = store.json.delete("decisions", opts.reject);

package/dist/core/checkreport.js

@@ -4,18 +4,18 @@
  *  then renders it as text (terminal, unchanged) or markdown (a PR comment posted
  *  by the GitHub Action). The exit-code decision lives with the caller. */
 export function reportIsClean(r) {
-    return r.direct.length === 0 && r.near.length === 0 && r.regressions.length === 0;
+    return r.direct.length === 0 && r.near.length === 0 && r.regressions.length === 0 && r.vetoes.length === 0;
 }
 /** True when --strict should FAIL the commit/PR. */
 export function reportFailsStrict(r) {
-    return r.strict && (r.strictBlockers > 0 || r.regBlocking > 0);
+    return r.strict && (r.strictBlockers > 0 || r.regBlocking > 0 || r.vetoBlocking > 0);
 }
 const mark = (s) => (s === "blocking" ? "⛔" : s === "warning" ? "⚠" : "·");
 const clip = (s, n = 160) => (s.length > n ? s.slice(0, n - 1).trimEnd() + "…" : s);
 /** The deterministic VERDICT for a merge: block (a hard gate fired), warn (touches
  *  memory but nothing hard-blocks), or pass (touches no recorded memory at all). */
 export function verdict(r) {
-    if (r.strictBlockers > 0 || r.regBlocking > 0)
+    if (r.strictBlockers > 0 || r.regBlocking > 0 || r.vetoBlocking > 0)
         return "block";
     return reportIsClean(r) ? "pass" : "warn";
 }
@@ -70,10 +70,17 @@ export function renderText(r) {
             out.push(`  ${h.blocking ? "⛔" : "⚠"} re-adds ${h.kind} \`${h.name}\` — ${h.decision} removed it${h.blocking ? " (blocking-linked)" : ""}\n      “${h.title}”\n      ${h.reason}`);
         }
     }
+    if (r.vetoes.length) {
+        out.push(`${r.direct.length || r.near.length || r.regressions.length ? "\n" : ""}Reverses ${r.vetoes.length} decision(s) you rejected:\n`);
+        for (const v of r.vetoes) {
+            out.push(`  ${v.blocking ? "⛔" : "⚠"} ${v.decision} rejected this approach${v.blocking ? " (human-confirmed)" : " (advisory)"}\n      you rejected: ${clip(v.alternative)}\n      you chose:    ${clip(v.chosen)}\n      evidence: ${v.evidence.slice(0, 4).join(", ")}`);
+        }
+    }
     if (reportFailsStrict(r)) {
         const reasons = [
             r.strictBlockers ? `${r.strictBlockers} high-confidence blocking invariant(s) directly in scope` : "",
             r.regBlocking ? `${r.regBlocking} blocking-linked regression(s)` : "",
+            r.vetoBlocking ? `${r.vetoBlocking} reversed-decision veto(es)` : "",
         ].filter(Boolean).join(" + ");
         out.push(`\n✗ ${reasons} — review before committing.`);
     }
@@ -125,11 +132,22 @@ export function renderMarkdown(r) {
         }
         out.push("");
     }
+    if (r.vetoes.length) {
+        out.push(`### ⛔ Reverses a decision you rejected`);
+        for (const v of r.vetoes) {
+            out.push(`- ${v.blocking ? "⛔" : "⚠"} \`${v.decision}\` rejected this approach${v.blocking ? " **(human-confirmed)**" : " _(advisory)_"}`);
+            out.push(`  - you rejected: _${clip(v.alternative)}_`);
+            out.push(`  - you chose: ${clip(v.chosen)}`);
+            out.push(`  - evidence: ${v.evidence.slice(0, 4).map((e) => `\`${e}\``).join(", ")}`);
+        }
+        out.push("");
+    }
     out.push("---");
     if (reportFailsStrict(r)) {
         const reasons = [
             r.strictBlockers ? `${r.strictBlockers} high-confidence blocking invariant(s) directly in scope` : "",
             r.regBlocking ? `${r.regBlocking} blocking-linked regression(s)` : "",
+            r.vetoBlocking ? `${r.vetoBlocking} reversed-decision veto(es)` : "",
         ].filter(Boolean).join(" + ");
         out.push(`❌ **This PR breaks ${reasons}.** Resolve or supersede the decision before merge.`);
     }

package/dist/core/hookpolicy.js

@@ -19,4 +19,25 @@ export function blockingInScope(store, file) {
     }
     return null;
 }
+/** Return a BlockingHit if the proposed added lines for `file` re-introduce an
+ *  approach an in-force decision deliberately REJECTED (a blocking veto), else null.
+ *  The deny text states ONLY the decision + receipt (what was rejected, what was
+ *  chosen) — never how to supersede or disable the guard, so an autonomous agent
+ *  cannot be coached into reversing a decision to land its edit (dec_a466655539). */
+/** Flatten the proposed-edit text from a PreToolUse `tool_input` across all three
+ *  edit tools — Edit (`new_string`), Write (`content`), MultiEdit (`edits[].new_string`)
+ *  — into candidate added lines for the Veto Guard. Empty input → []. */
+export function proposedEditLines(toolInput) {
+    const parts = [toolInput?.new_string, toolInput?.content, ...(toolInput?.edits ?? []).map((e) => e?.new_string)]
+        .filter((s) => !!s);
+    return parts.length ? parts.join("\n").split("\n") : [];
+}
+export function vetoInScope(store, file, proposedAddedLines) {
+    const hit = store.vetoForFileEdit(file, proposedAddedLines).find((v) => v.blocks);
+    if (!hit)
+        return null;
+    return {
+        reason: `Hunch: editing ${file} would REVERSE decision ${hit.decision} — you rejected "${hit.alternative}" and chose "${hit.chosen}". Do not re-introduce the rejected approach; preserve the chosen design.`,
+    };
+}
 //# sourceMappingURL=hookpolicy.js.map

package/dist/core/strictgate.js

@@ -9,6 +9,12 @@
  *  on a shared repo: a false positive downgrades to a warning instead of wrongly
  *  failing a teammate's commit. */
 export const STRICT_MIN_CONFIDENCE = 0.8;
+/** Is a provenance source HUMAN-CONFIRMED? Token-aware, so a composite source like
+ *  "llm_draft+human_confirmed" counts, but a lookalike ("not_human_confirmed",
+ *  "human_confirmed_pending") does not. The sources Hunch writes are "+"-joined. */
+export function isHumanConfirmed(source) {
+    return (source ?? "").split("+").includes("human_confirmed");
+}
 /** May this invariant FAIL a commit under --strict? Requires blocking severity,
  *  a fresh (non-stale) record, and either high provenance confidence or a
  *  human-confirmed source (a person vouched for it). Near/blast-radius hits never
@@ -19,6 +25,21 @@ export function isStrictBlocker(c, stale) {
     if (stale)
         return false;
     const confidence = c.provenance?.confidence ?? 0;
-    return confidence >= STRICT_MIN_CONFIDENCE || c.provenance?.source === "human_confirmed";
+    return confidence >= STRICT_MIN_CONFIDENCE || isHumanConfirmed(c.provenance?.source);
+}
+/** May a VETO fail a commit? Sibling of isStrictBlocker, but keys on the TRIPWIRE's
+ *  trust — not the rejecting decision's — and uses ONE rule for every tier: only a
+ *  `human_confirmed` tripwire blocks. An llm_draft tripwire never blocks regardless
+ *  of confidence (an LLM self-score is not a licence to fail a commit); it only
+ *  warns. Semantic similarity never blocks. In-force + non-stale gates run first.
+ *  This is what makes the "day-one is advisory" DX true (dec_a466655539). */
+export function isVetoBlocker(d, tw, tier, stale) {
+    if (d.status === "superseded" || d.superseded_by)
+        return false; // in-force decisions only
+    if (stale)
+        return false; // freshness gate
+    if (tier === "semantic")
+        return false; // never block on similarity
+    return isHumanConfirmed(tw.provenance?.source); // confirmed ⇒ blocks, any tier
 }
 //# sourceMappingURL=strictgate.js.map

package/dist/core/types.js

@@ -74,6 +74,25 @@ export const RetiredSignalSchema = z.object({
     symbols: z.array(z.string()).default([]).describe("symbol names this decision removed"),
     deps: z.array(z.string()).default([]).describe("external deps this decision dropped"),
 });
+/** A machine-checkable signal for a REJECTED alternative (the Veto Guard). Unlike
+ *  `retired` (code that once existed and was removed), a rejected alternative never
+ *  existed in code, so its prose is turned into a testable set/regex. Carries its
+ *  OWN provenance, separate from the decision's: an LLM may DRAFT a tripwire
+ *  (advisory only); only a `human_confirmed` tripwire may BLOCK a commit — for every
+ *  tier. One predictable rule (dec_a466655539). See docs/veto.md. */
+export const RejectedTripwireSchema = z.object({
+    alternative: z.string().describe("the rejected approach's human text — printed verbatim in the receipt"),
+    scope: z.array(z.string()).default([]).describe("glob(s) it applies to, e.g. vscode-extension/**"),
+    forbids: z
+        .object({
+        deps: z.array(z.string()).default([]).describe("external imports that signal the rejected approach"),
+        symbols: z.array(z.string()).default([]).describe("identifier names that signal it"),
+        patterns: z.array(z.string()).default([]).describe("scoped line regexes (last resort)"),
+    })
+        .default({ deps: [], symbols: [], patterns: [] }),
+    embed_ref: z.string().optional().describe("optional handle into embeddings for the advisory semantic tier"),
+    provenance: ProvenanceSchema,
+});
 /** ADR-style decision record, auto-drafted and human-confirmable. */
 export const DecisionSchema = z.object({
     id: z.string().describe("dec_*"),
@@ -83,6 +102,7 @@ export const DecisionSchema = z.object({
     decision: z.string().default(""),
     consequences: z.array(z.string()).default([]),
     alternatives_rejected: z.array(z.string()).default([]),
+    rejected_tripwires: z.array(RejectedTripwireSchema).default([]).describe("machine-checkable signals for alternatives_rejected (Veto Guard)"),
     related_components: z.array(z.string()).default([]),
     related_files: z.array(z.string()).default([]),
     supersedes: z.string().nullable().default(null),

package/dist/extractors/diff.js

@@ -45,6 +45,7 @@ export function analyzeDiff(diff) {
     const perFile = new Map();
     const addedImports = new Set();
     const removedImports = new Set();
+    const addedLinesBy = new Map();
     let addedLines = 0;
     let removedLines = 0;
     let curFile = "";
@@ -120,6 +121,12 @@ export function analyzeDiff(diff) {
             if (!curAdded && !curDeleted)
                 filesModified.add(curFile);
             const body = raw.slice(1);
+            let lines = addedLinesBy.get(curFile);
+            if (!lines) {
+                lines = [];
+                addedLinesBy.set(curFile, lines);
+            }
+            lines.push(body);
             const d = declOf(body);
             if (d)
                 declsFor(curFile)?.added.set(d.name, d);
@@ -171,6 +178,7 @@ export function analyzeDiff(diff) {
         removedDeps: [...removedImports].filter((d) => !addedImports.has(d)),
         addedLines,
         removedLines,
+        addedLinesByFile: addedLinesBy,
     };
 }
 /** A compact human-readable summary of a DiffAnalysis (used in decision text). */

package/dist/integrations/gitignore.js

@@ -30,6 +30,12 @@ export function ensureGitignore(root) {
     const cur = readFileSync(path, "utf8");
     if (cur.includes(MARK))
         return { path, action: "unchanged" }; // already managed
+    // Already covered by the user's OWN entries (e.g. a hand-written, commented
+    // section listing the same patterns)? Don't append a redundant managed block —
+    // that would leave two copies of every ignore. Keep the .gitignore clean.
+    const lines = new Set(cur.split("\n").map((l) => l.trim()));
+    if (ENTRIES.every((e) => lines.has(e)))
+        return { path, action: "unchanged" };
     const sep = cur.endsWith("\n") || cur.length === 0 ? "" : "\n";
     writeFileSync(path, `${cur}${sep}${block}\n`);
     return { path, action: "appended" };

package/dist/mcp/server.js

@@ -263,6 +263,7 @@ export function buildServer(root) {
                 decision: decision.decision ?? existing?.decision ?? "",
                 consequences: decision.consequences ?? [],
                 alternatives_rejected: decision.alternatives_rejected ?? [],
+                rejected_tripwires: existing?.rejected_tripwires ?? [], // preserve confirmed tripwires across re-record
                 related_components: decision.related_components ?? existing?.related_components ?? [],
                 related_files: (decision.related_files ?? existing?.related_files ?? []).map(toPosixTarget),
                 supersedes: decision.supersedes ?? existing?.supersedes ?? null,

package/dist/store/hunchStore.js

@@ -18,7 +18,7 @@ import { selectEmbedder } from "./embedder.js";
 import { JsonStore } from "./jsonStore.js";
 import { pathMatchesGlob } from "../core/glob.js";
 import { edgeId } from "../core/ids.js";
-import { isStrictBlocker } from "../core/strictgate.js";
+import { isStrictBlocker, isVetoBlocker } from "../core/strictgate.js";
 import { analyzeDiff } from "../extractors/diff.js";
 export class HunchStore {
     paths;
@@ -439,9 +439,10 @@ export class HunchStore {
                 }
         const an = analyzeDiff(diff);
         const regHits = this.regressionHits({ symbols: an.addedSymbols.map((s) => s.name), deps: an.addedDeps }, files);
-        const staleIds = opts.strict && opts.lastChange
-            ? new Set(this.staleness(opts.lastChange).filter((s) => s.kind === "constraint").map((s) => s.id))
-            : new Set();
+        const staleRecords = opts.strict && opts.lastChange ? this.staleness(opts.lastChange) : [];
+        const staleIds = new Set(staleRecords.filter((s) => s.kind === "constraint").map((s) => s.id));
+        const staleDecisionIds = new Set(staleRecords.filter((s) => s.kind === "decision").map((s) => s.id));
+        const vetoes = this.vetoHits(an, files, staleDecisionIds);
         const directReport = [...direct.values()].map(({ c, files: fs }) => {
             const stale = staleIds.has(c.id);
             const strictBlocks = isStrictBlocker(c, stale);
@@ -458,8 +459,10 @@ export class HunchStore {
             direct: directReport,
             near: [...near.values()].map(({ c, via }) => ({ id: c.id, severity: c.severity ?? "advisory", statement: c.statement, via })),
             regressions: regHits.map((h) => ({ kind: h.kind, name: h.name, decision: h.decision, title: h.title, reason: h.reason, blocking: h.blocking })),
+            vetoes: vetoes.map((v) => ({ decision: v.decision, title: v.title, alternative: v.alternative, chosen: v.chosen, tier: v.tier, evidence: v.evidence, blocking: v.blocks })),
             strictBlockers: directReport.filter((d) => d.strictBlocks).length,
             regBlocking: regHits.filter((h) => h.blocking).length,
+            vetoBlocking: vetoes.filter((v) => v.blocks).length,
         };
     }
     /** Time-travel: the decision history for a target — every decision touching it,
@@ -542,6 +545,82 @@ export class HunchStore {
         }
         return out;
     }
+    /** Veto Guard: detect a change RE-INTRODUCING an approach an in-force decision
+     *  deliberately REJECTED (`decision.rejected_tripwires`). The counterpart to
+     *  regressionHits, which only sees code that once existed — a rejected alternative
+     *  never did. Precision-first ladder (dep > symbol > pattern); the semantic tier is
+     *  advisory and lives elsewhere. A hit `blocks` only when isVetoBlocker passes (a
+     *  human-confirmed tripwire on an in-force, non-stale decision — dec_a466655539).
+     *  Read-only; shared by buildCheckReport. See docs/veto.md. */
+    vetoHits(an, files, staleDecisions = new Set()) {
+        const addedDeps = new Set(an.addedDeps);
+        const out = [];
+        const seen = new Set(); // dedup: one hit per decision+alternative
+        for (const d of this.json.loadAll("decisions")) {
+            if (d.superseded_by || d.status === "superseded")
+                continue; // in-force only
+            const tripwires = d.rejected_tripwires ?? [];
+            if (!tripwires.length)
+                continue;
+            const stale = staleDecisions.has(d.id);
+            for (const tw of tripwires) {
+                // scope: a tripwire with globs must intersect the touched files; scopeless = any
+                const scopedFiles = tw.scope.length
+                    ? files.filter((f) => tw.scope.some((g) => pathMatchesGlob(f, g)))
+                    : files;
+                if (tw.scope.length && !scopedFiles.length)
+                    continue;
+                // added line bodies within the scoped files (call sites, not just decls)
+                const scopedAdded = [];
+                for (const f of scopedFiles) {
+                    const lines = an.addedLinesByFile.get(f);
+                    if (lines)
+                        scopedAdded.push(...lines);
+                }
+                const match = matchTripwire(tw, addedDeps, scopedAdded);
+                if (!match)
+                    continue;
+                const key = `${d.id}::${tw.alternative}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                out.push({
+                    decision: d.id,
+                    title: d.title,
+                    alternative: tw.alternative,
+                    chosen: d.decision || d.title,
+                    tier: match.tier,
+                    evidence: [...match.evidence, ...scopedFiles.slice(0, 3)],
+                    blocks: isVetoBlocker(d, tw, match.tier, stale),
+                    why: d.caused_by_bug ? this.vetoWhy(d.caused_by_bug) : undefined,
+                });
+            }
+        }
+        return out;
+    }
+    /** Resolve a veto's causal citation: the bug whose root cause spawned the decision
+     *  (decision → caused_by_bug). Distinct from causalChain, which is constraint-keyed. */
+    vetoWhy(bugId) {
+        const bug = this.json.get("bugs", bugId);
+        return bug ? { bug: { id: bug.id, title: bug.title, root_cause: bug.root_cause } } : undefined;
+    }
+    /** Veto check for a LIVE edit (the agent pre-edit hook): no diff exists yet, so
+     *  synthesize a minimal added-only diff from the proposed new lines and run the
+     *  same vetoHits ladder. Freshness needs git lastChange (unavailable at edit time),
+     *  so the staleness gate is skipped here — the commit/CI path applies it. */
+    vetoForFileEdit(file, addedLines) {
+        if (!addedLines.length)
+            return [];
+        const f = toPosixTarget(file);
+        const synthetic = [
+            `diff --git a/${f} b/${f}`,
+            `--- a/${f}`,
+            `+++ b/${f}`,
+            `@@ -0,0 +1,${addedLines.length} @@`,
+            ...addedLines.map((l) => `+${l}`),
+        ].join("\n");
+        return this.vetoHits(analyzeDiff(synthetic), [f]);
+    }
     /** The symbols/deps an in-force decision deliberately RETIRED from a file — the
      *  agent-hook grounding ("don't re-add X here; dec_Y removed it"). No diff is
      *  available at edit time, so this surfaces the risk as context, not a block. */
@@ -669,6 +748,49 @@ export class HunchStore {
         return ctx;
     }
 }
+/** Walk a tripwire's precision-first ladder against an analyzed diff. dep (exact
+ *  set intersection) > symbol (whole-word identifier in an added line) > pattern
+ *  (scoped regex). Returns the highest-precision match, or null. Bad user/LLM regex
+ *  is compiled defensively and never throws (a malformed pattern is simply inert). */
+function matchTripwire(tw, addedDeps, scopedAdded) {
+    // dep tier: the forbidden dep must be a genuinely-new external import (addedDeps)
+    // AND imported in a SCOPED added line — not merely added somewhere else in the
+    // diff. Without the scoped check, axios added in an out-of-scope file plus any
+    // edit to an in-scope file would false-positive.
+    const hitDeps = tw.forbids.deps.filter((dep) => addedDeps.has(dep) && scopedAdded.some((l) => importsDep(l, dep)));
+    if (hitDeps.length)
+        return { tier: "dep", evidence: hitDeps.map((d) => `+import ${d}`) };
+    const hitSyms = tw.forbids.symbols.filter((s) => {
+        const re = new RegExp(`\\b${escapeRe(s)}\\b`);
+        return scopedAdded.some((l) => re.test(l));
+    });
+    if (hitSyms.length)
+        return { tier: "symbol", evidence: hitSyms.map((s) => `+${s}`) };
+    for (const p of tw.forbids.patterns) {
+        let re = null;
+        try {
+            re = new RegExp(p);
+        }
+        catch {
+            re = null; // malformed pattern is inert, never a thrown error in the gate
+        }
+        if (!re)
+            continue;
+        const hit = scopedAdded.find((l) => re.test(l));
+        if (hit)
+            return { tier: "pattern", evidence: [`/${p}/ matched: ${hit.trim().slice(0, 80)}`] };
+    }
+    return null;
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Does an added line actually IMPORT `dep` (not merely mention it in a string)?
+ *  Covers `import x from "dep"`, `import "dep"`, `} from "dep"`, `require("dep")` —
+ *  so a literal like `const m = "axios"` no longer trips the dep tier. */
+function importsDep(line, dep) {
+    return new RegExp(`(?:from|import|require\\(?)\\s*['"]${escapeRe(dep)}['"]`).test(line);
+}
 function sev(s) {
     return { blocking: 3, warning: 2, advisory: 1 }[s] ?? 0;
 }

package/dist/synthesis/synthesize.js

@@ -3,6 +3,7 @@ import { analyzeDiff } from "../extractors/diff.js";
 import { selectProvider, DeterministicProvider } from "./provider.js";
 import { decisionId, bugId, constraintId } from "../core/ids.js";
 import { pathMatchesGlob } from "../core/glob.js";
+import { draftTripwires, knownRepoDeps } from "./tripwires.js";
 const CODE_RE = /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
 const SKIP_SUBJECT = /^(merge|revert|bump|chore\(deps\)|format|lint|wip)\b/i;
 // Below this many changed code lines, a commit with no structural change and no
@@ -90,6 +91,12 @@ export async function syncCommit(store, root, sha, opts = {}) {
         decision: draft.decision,
         consequences: draft.consequences,
         alternatives_rejected: draft.alternatives_rejected,
+        // Capture-time drafting: scaffold ADVISORY tripwires from the rejected
+        // alternatives (preserve any already-curated ones across re-sync). All llm_draft
+        // → never block until confirmed via `hunch review --accept` (dec_a466655539).
+        rejected_tripwires: existing?.rejected_tripwires?.length
+            ? existing.rejected_tripwires
+            : draftTripwires(draft.alternatives_rejected, codeFiles, knownRepoDeps(root)),
         related_components: relatedComponents,
         related_files: codeFiles,
         supersedes: existing?.supersedes ?? null,

package/dist/synthesis/tripwires.js

@@ -0,0 +1,63 @@
+/**
+ * Deterministic DRAFT-tripwire scaffolding for the Veto Guard (tier 6). Both the
+ * capture path (synthesize.ts) and `hunch veto backfill` use this to turn a
+ * decision's `alternatives_rejected` prose into machine-checkable tripwires —
+ * always `llm_draft`, so they are ADVISORY ONLY until a human confirms them
+ * (dec_a466655539). The LLM may later enrich the same shape; this is the no-LLM
+ * floor that keeps the feature useful offline.
+ */
+import { existsSync, readFileSync } from "node:fs";
+/** Scaffold one draft tripwire per rejected alternative. Scope = directory globs of
+ *  the decision's related files. `forbids` is best-effort from the prose: known repo
+ *  dependencies named in the text, plus backticked identifiers as candidate symbols.
+ *  Empty `forbids` is fine — the tripwire is then inert until a human fills it in. */
+export function draftTripwires(alternatives, relatedFiles, knownDeps) {
+    const scope = dirGlobs(relatedFiles);
+    return alternatives.map((alt) => ({
+        alternative: alt,
+        scope,
+        forbids: {
+            deps: knownDeps.filter((dep) => mentions(alt, dep)),
+            symbols: [...alt.matchAll(/`([A-Za-z_$][\w$]*)`/g)].map((m) => m[1]),
+            patterns: [],
+        },
+        provenance: { source: "llm_draft", confidence: 0.5, evidence: [] },
+    }));
+}
+/** External dependency names declared in the repo's package.json (every section),
+ *  used to recognise a dep named in a rejected-alternative sentence. */
+export function knownRepoDeps(root) {
+    const p = `${root}/package.json`;
+    if (!existsSync(p))
+        return [];
+    try {
+        const pkg = JSON.parse(readFileSync(p, "utf8"));
+        return Object.keys({
+            ...pkg.dependencies,
+            ...pkg.devDependencies,
+            ...pkg.peerDependencies,
+            ...pkg.optionalDependencies,
+        });
+    }
+    catch {
+        return []; // unparseable package.json → no auto-deps, never throw
+    }
+}
+/** Whole-token match of a dep name in prose (handles scoped/hyphenated names like
+ *  `node-fetch` or `@scope/pkg` without matching inside a larger word). */
+function mentions(text, dep) {
+    return new RegExp(`(^|[^\\w@/-])${escapeRe(dep)}([^\\w@/-]|$)`).test(text);
+}
+function dirGlobs(files) {
+    const set = new Set();
+    for (const f of files) {
+        const i = f.lastIndexOf("/");
+        if (i > 0)
+            set.add(`${f.slice(0, i)}/**`);
+    }
+    return [...set];
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+//# sourceMappingURL=tripwires.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "0.14.2",
+  "version": "0.15.0",
   "license": "MIT",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Hunch — an Engineering Memory OS: a persistent, git-native reasoning graph over a codebase, exposed to Claude Code via MCP.",