@davesheffer/hunch 1.10.2 → 1.10.3

package/dist/cli/index.js

@@ -68,7 +68,7 @@ import { computeDrift } from "../core/drift.js";
 import { renderCompilerScorecard, scoreCompilerCaseBank } from "../constitution/scorecard.js";
 import { generateWiki, wikiStatus, wikiPrompt, publicHome, privateHome, readWikiManifestAt, nowData } from "../wiki/wiki.js";
 import { adoptProsePrompt } from "../wiki/adopt.js";
-import { topicCollisions, renderGrounding } from "../core/topics.js";
+import { topicCollisions, renderGrounding, isInForce } from "../core/topics.js";
 import { pendingEscalations, policyEscalations } from "../core/escalations.js";
 import { parseDocAnchors, renderDocGrounding } from "../core/docanchors.js";
 import { compareCandidates } from "../core/compare.js";
@@ -3420,7 +3420,7 @@ vetoCmd
     let drafted = 0;
     let touched = 0;
     for (const d of store.json.loadAll("decisions")) {
-        if (d.superseded_by || d.status === "superseded")
+        if (!isInForce(d))
             continue;
         if (!d.alternatives_rejected.length)
             continue;

package/dist/constitution/repairPolicies.js

@@ -30,9 +30,16 @@ export function planPolicyRepair(renames, policies) {
                 rewrites.push({ id: p.id, field: "scope.paths", from: path, to });
         }
         if (p.assertion.kind !== "executable-behavior") {
+            // must-pass-through carries a THIRD selector (`via`). Omitting it meant an
+            // ordinary rename left the via binding pointing at the old symbol: the policy
+            // either bricked (its semantic hash moved, invalidating the proof, while the
+            // stale via could never be re-proved) or silently stopped enforcing. This runs
+            // automatically from the post-commit hook, so neither outcome was visible.
             const selectors = p.assertion.kind === "exists"
                 ? [p.assertion.subject.selector]
-                : [p.assertion.subject.selector, p.assertion.object.selector];
+                : p.assertion.kind === "must-pass-through"
+                    ? [p.assertion.subject.selector, p.assertion.via.selector, p.assertion.object.selector]
+                    : [p.assertion.subject.selector, p.assertion.object.selector];
             for (const raw of selectors) {
                 const healed = repairSelector(raw, map);
                 if (healed !== raw)
@@ -54,11 +61,18 @@ export function repairPolicySpec(policy, rewrites, at) {
         ? policy.assertion
         : policy.assertion.kind === "exists"
             ? { ...policy.assertion, subject: { selector: subSelector(policy.assertion.subject.selector) } }
-            : {
-                ...policy.assertion,
-                subject: { selector: subSelector(policy.assertion.subject.selector) },
-                object: { selector: subSelector(policy.assertion.object.selector) },
-            };
+            : policy.assertion.kind === "must-pass-through"
+                ? {
+                    ...policy.assertion,
+                    subject: { selector: subSelector(policy.assertion.subject.selector) },
+                    via: { selector: subSelector(policy.assertion.via.selector) },
+                    object: { selector: subSelector(policy.assertion.object.selector) },
+                }
+                : {
+                    ...policy.assertion,
+                    subject: { selector: subSelector(policy.assertion.subject.selector) },
+                    object: { selector: subSelector(policy.assertion.object.selector) },
+                };
     return {
         ...policy,
         revision: policy.revision + 1,

package/dist/core/conformance.js

@@ -1,4 +1,5 @@
 import { externalImportNodeId } from "./externalImports.js";
+import { isInForce } from "./topics.js";
 function resolveSymbols(graph, ref) {
     const syms = graph.symbols;
     if (ref.startsWith("sym_"))
@@ -102,8 +103,8 @@ export function checkConformance(store, opts = {}) {
     const graph = opts.graph ?? { symbols: load("symbols"), edges: load("edges") };
     const out = [];
     for (const d of load("decisions")) {
-        if (d.status === "superseded" || d.superseded_by)
-            continue; // in-force decisions only
+        if (!isInForce(d))
+            continue; // in-force only — a REJECTED intent is not an intent
         for (const p of d.conformance ?? [])
             out.push(evalPredicate(graph, d, p));
     }

package/dist/core/strictgate.js

@@ -8,6 +8,7 @@
  *  weaker signals still print, as advisory. This makes strict mode safe to enable
  *  on a shared repo: a false positive downgrades to a warning instead of wrongly
  *  failing a teammate's commit. */
+import { isInForce } from "./topics.js";
 export const STRICT_MIN_CONFIDENCE = 0.8;
 /** Is a provenance source HUMAN-CONFIRMED? Token-aware, so a composite source like
  *  "llm_draft+human_confirmed" counts, but a lookalike ("not_human_confirmed",
@@ -34,8 +35,10 @@ export function isStrictBlocker(c, stale) {
  *  warns. Semantic similarity never blocks. In-force + non-stale gates run first.
  *  This is what makes the "day-one is advisory" DX true (dec_a466655539). */
 export function isVetoBlocker(d, tw, tier, stale) {
-    if (d.status === "superseded" || d.superseded_by)
-        return false; // in-force decisions only
+    // Shared in-force predicate (core/topics.ts): superseded, REJECTED and
+    // window-closed decisions all lose their teeth here, not just superseded ones.
+    if (!isInForce(d))
+        return false;
     if (stale)
         return false; // freshness gate
     if (tier === "semantic")

package/dist/core/topics.js

@@ -4,6 +4,21 @@
 export function isLive(d) {
     return d.status === "accepted" && d.superseded_by === null && d.valid_to === null;
 }
+/** In force for ENFORCEMENT — the one predicate every guard must share.
+ *
+ *  Deliberately BROADER than `isLive`: a `proposed` draft still contributes ADVISORY
+ *  signal (its tripwires are `llm_draft`, which `isVetoBlocker` can never promote to a
+ *  block), and that is the curate loop working as designed. What must never contribute
+ *  is a decision the team formally REJECTED, or one whose valid-time window was closed.
+ *
+ *  The guards previously each inlined a weaker `superseded`-only copy of this test, so a
+ *  REJECTED decision kept driving the veto, regression, retired-symbol and conformance
+ *  guards — it went on blocking commits and injecting "don't re-add this" into the
+ *  pre-edit hook, with no way to un-stick it short of hand-editing the JSON. Structural
+ *  parameter so the strict gate (which sees only a partial record) shares it too. */
+export function isInForce(d) {
+    return d.status !== "superseded" && d.status !== "rejected" && !d.superseded_by && !d.valid_to;
+}
 /** Every live decision anchored to `topic`. In a healthy graph this is length 0 or 1;
  *  length > 1 is a topic collision the §4 resolution must settle. */
 export function liveForTopic(decisions, topic) {

package/dist/mcp/server.js

@@ -821,10 +821,14 @@ export function buildServerWithRootControl(initialRoot) {
             // Route the write to its ONE home: an explicit private:true goes to the overlay
             // (putPrivate throws rather than silently falling public); in unified ("shared")
             // mode EVERY capture goes to the overlay; else the public store.
-            if (home === "private")
-                store.putPrivate("decisions", rec);
-            else
-                store.json.put("decisions", rec);
+            // Through putCapture, NOT the raw per-home writers: it carries the cross-home
+            // twin guard. Branching on `home` here bypassed that guard, so one id could
+            // exist in BOTH stores — after which the merged/private-first read makes the
+            // topic-uniqueness check see one record while a later public `supersedes:`
+            // closes the other, leaving two live decisions on one topic and grounding
+            // silently injecting nothing for it. The guard throws; the surrounding catch
+            // turns that into a clean tool error instead of a silent twin.
+            store.putCapture("decisions", rec, !!decision.private);
             // Invalidate, don't delete: closing the superseded decision's valid-time window
             // (+ a supersedes edge) preserves the why-it-changed trail. Route the close to the
             // same store the new record landed in — a private decision supersedes within the
@@ -890,10 +894,8 @@ export function buildServerWithRootControl(initialRoot) {
                 return err(`Refusing to record public correction ${rec.id}: source decision ${rec.source_decision} ${location}.`);
             }
             const existing = home === "private" ? store.getPrivateRec("constraints", rec.id) : store.json.get("constraints", rec.id);
-            if (home === "private")
-                store.putPrivate("constraints", rec);
-            else
-                store.json.put("constraints", rec);
+            // Same cross-home twin guard as the decision path above.
+            store.putCapture("constraints", rec, !!input.private);
             store.reindex();
             // Propagate the new rule to EVERY assistant's ambient grounding (Cursor/Copilot/
             // Windsurf/AGENTS.md/CLAUDE.md), so a correction captured in one assistant is held

package/dist/store/hunchStore.js

@@ -20,7 +20,7 @@ import { selectEmbedder } from "./embedder.js";
 import { JsonStore } from "./jsonStore.js";
 import { gitCommonDir, gitWorktreeRoot, sameGitPublication } from "../extractors/git.js";
 import { pathMatchesGlob } from "../core/glob.js";
-import { currentForTopic } from "../core/topics.js";
+import { currentForTopic, isInForce } from "../core/topics.js";
 import { edgeId } from "../core/ids.js";
 import { isStrictBlocker, isVetoBlocker } from "../core/strictgate.js";
 import { effectiveForbids, matchForbids } from "../core/constraintmatch.js";
@@ -1254,9 +1254,9 @@ export class HunchStore {
         // attribution (the strict guard fails on `blocking`).
         const ordered = [...decisions].sort((a, b) => Number(blockingDec.has(b.id)) - Number(blockingDec.has(a.id)));
         for (const d of ordered) {
-            // Only IN-FORCE decisions: re-adding what an OUTDATED (superseded) decision
-            // removed is not a regression against the current design.
-            if (d.superseded_by || d.status === "superseded")
+            // Only IN-FORCE decisions: re-adding what an OUTDATED (superseded), REJECTED, or
+            // window-closed decision removed is not a regression against the current design.
+            if (!isInForce(d))
                 continue;
             if (!d.retired.symbols.length && !d.retired.deps.length)
                 continue;
@@ -1283,8 +1283,8 @@ export class HunchStore {
         const out = [];
         const seen = new Set(); // dedup: one hit per decision+alternative
         for (const d of this.recs("decisions")) {
-            if (d.superseded_by || d.status === "superseded")
-                continue; // in-force only
+            if (!isInForce(d))
+                continue; // in-force only (excludes rejected + window-closed)
             const tripwires = d.rejected_tripwires ?? [];
             if (!tripwires.length)
                 continue;
@@ -1353,7 +1353,7 @@ export class HunchStore {
     retiredForFile(file) {
         const out = [];
         for (const d of this.recs("decisions")) {
-            if (d.superseded_by || d.status === "superseded")
+            if (!isInForce(d))
                 continue;
             if (!d.retired.symbols.length && !d.retired.deps.length)
                 continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Engineering memory and a deterministic Change Gate for AI-assisted codebases: decisions, rejected approaches, constraints, and bug lineage become portable context and opt-in enforcement for every MCP assistant.",