@davesheffer/hunch 1.15.0 → 1.17.0

package/README.md

@@ -6,9 +6,10 @@
 [![GitHub stars](https://img.shields.io/github/stars/davesheffer/hunch?color=2742ff&label=%E2%98%85%20star)](https://github.com/davesheffer/hunch)
 [![license](https://img.shields.io/npm/l/@davesheffer/hunch?color=2742ff)](LICENSE)
 
-Hunch is the engineering-memory and architectural-conformance layer for AI-assisted codebases. It
-records the decisions, constraints, rejected approaches, and bug history behind your code, delivers
-the relevant evidence before an assistant changes anything, then checks the result deterministically.
+Hunch is a guarantee: **your agents never re-make a decided decision, and never re-introduce a
+fixed bug.** The mechanism behind it is an engineering-memory and architectural-conformance layer —
+the decisions, constraints, rejected approaches, and bug history behind your code, delivered as
+evidence before an assistant changes anything, with the result checked deterministically after.
 
 Memory starts **advisory**. Nothing blocks until you explicitly trust a precise rule and choose
 strict enforcement.
@@ -16,8 +17,10 @@ strict enforcement.
 **Memory is the input. The product boundary is the receipt:** relevant evidence before an edit,
 then a deterministic check of the change against the rules your team has explicitly trusted.
 
-> **New in v1.13.1:** `hunch_context` exposes that provenance-checked, hard-budgeted delivery
-> envelope as MCP structured output and records exactly which returned items reached the client.
+> **New in v1.17.0:** an exported ADR corpus now tracks the graph automatically and reports its
+> own drift (`madr-stale` / `madr-edited` / `madr-orphan`), and retrieval ranks recorded intent
+> above code symbols that merely share the query's vocabulary — Recall@10 70% → 90% on the
+> curated benchmark.
 
 See the public [roadmap](ROADMAP.md) for what is next and what is deliberately out of scope.
 
@@ -47,8 +50,11 @@ to the same graph. It merges into existing configuration instead of replacing it
 - **Change receipts** — review a working tree, commit, or branch against recorded intent and get a
   cited PASS / WARN / BLOCK result.
 - **Bug lineage** — understand which old incident a line fixed before accidentally undoing it.
-- **Code awareness** — TypeScript, JavaScript, and Python structure feed dependency, blast-radius,
-  and redundancy checks. The reasoning layer works with any language.
+- **Code awareness** — TypeScript, JavaScript, Python, and Go structure feed dependency,
+  blast-radius, and redundancy checks. The reasoning layer works with any language.
+- **ADR interop** — `hunch import-adr` populates the graph from an existing MADR/Nygard corpus;
+  `hunch export-adr` projects it back as standard MADR any ADR reader understands, and the
+  projection then tracks the graph automatically and reports its own drift.
 
 The source of truth is readable JSON in `.hunch/`. A local SQLite index makes retrieval fast but
 is always rebuildable.

package/dist/cli/index.js

@@ -14,7 +14,7 @@
  *   doctor    environment diagnostics
  */
 import "./preflight.js"; // MUST stay the first import — Node-version gate before node:sqlite loads
-import { chmodSync, existsSync, lstatSync, readFileSync, readlinkSync, writeFileSync, mkdirSync, mkdtempSync, realpathSync, rmSync, rmdirSync, symlinkSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, writeFileSync, mkdirSync, mkdtempSync, realpathSync, rmSync, rmdirSync, symlinkSync } from "node:fs";
 import { execFileSync, spawnSync } from "node:child_process";
 import { join, relative, dirname, basename, resolve, isAbsolute } from "node:path";
 import { tmpdir } from "node:os";
@@ -70,7 +70,10 @@ import { computeDrift } from "../core/drift.js";
 import { renderCompilerScorecard, scoreCompilerCaseBank } from "../constitution/scorecard.js";
 import { generateWiki, wikiStatus, wikiPrompt, publicHome, privateHome, readWikiManifestAt, nowData } from "../wiki/wiki.js";
 import { adoptProsePrompt } from "../wiki/adopt.js";
-import { topicCollisions, isInForce } from "../core/topics.js";
+import { topicCollisions, isInForce, liveForTopic } from "../core/topics.js";
+import { ADR_DIR_CANDIDATES, ADR_FILE_RE, mapAdrCorpus } from "../extractors/adrImport.js";
+import { exportMadrCorpus, isRegenerableMadr } from "../integrations/madrExport.js";
+import { buildMadrManifest, writeMadrManifest, refreshMadrCorpus } from "../integrations/madrManifest.js";
 import { pendingEscalations, policyEscalations } from "../core/escalations.js";
 import { premiseEscalations } from "../core/premises.js";
 import { parseDocAnchors, renderDocGrounding } from "../core/docanchors.js";
@@ -498,6 +501,21 @@ program
     else if (!opts.quiet) {
         console.log(`· skipped: ${r.reason}`);
     }
+    // The MADR projection tracks the graph automatically once adopted, the way the
+    // SQLite index does — a user who ran `hunch export-adr` once never runs it again.
+    // Best-effort and last-write-wins-free: a hand-edited file is skipped, not
+    // clobbered, and any failure here must never affect the capture that preceded it.
+    try {
+        const refreshed = refreshMadrCorpus(store.json.loadAll("decisions"), root, new Date().toISOString());
+        if (refreshed && !opts.quiet && (refreshed.written || refreshed.removed || refreshed.skippedEdited.length)) {
+            const skipped = refreshed.skippedEdited.length ? `, ${refreshed.skippedEdited.length} hand-edited file(s) left alone` : "";
+            console.log(`  ↳ ADR corpus refreshed: ${refreshed.written} written, ${refreshed.removed} removed${skipped} (${refreshed.dir}/)`);
+        }
+    }
+    catch (e) {
+        if (!opts.quiet)
+            console.log(`  ↳ ADR corpus refresh skipped safely: ${e.message}`);
+    }
     let graphRefreshed = false;
     let publicCorrectionQueued = false;
     let privateCorrectionQueued = false;
@@ -2984,6 +3002,128 @@ program
         console.log(`  ↳ promoted constraint ${r.constraint.id} [${r.constraint.severity}]: ${r.constraint.statement}`);
     store.close();
 });
+// ---- import-adr (MADR/Nygard corpus import — the MADR bridge, import half) --
+program
+    .command("import-adr")
+    .description("Import an existing MADR/Nygard ADR corpus (docs/adr etc.) into the decision graph — deterministic, no LLM. Re-running updates the same records (ids derive from file paths).")
+    .argument("[dir]", "ADR directory (default: probe docs/adr, docs/decisions, doc/adr, adr, docs/architecture/decisions)")
+    .option("--dry-run", "parse and report what would be imported without writing")
+    .option("--private", "write imported decisions into the private overlay instead of the committed store")
+    .action((dirArg, opts) => {
+    const { store, root } = storeFor();
+    try {
+        const dir = dirArg
+            ? toPosixTarget(dirArg)
+            : ADR_DIR_CANDIDATES.find((c) => existsSync(join(root, c)) && readdirSync(join(root, c)).some((f) => ADR_FILE_RE.test(f)));
+        if (!dir || !existsSync(join(root, dir))) {
+            return fail(dirArg ? `ADR directory not found: ${dirArg}` : `no ADR corpus found (probed: ${ADR_DIR_CANDIDATES.join(", ")})`);
+        }
+        const files = readdirSync(join(root, dir)).filter((f) => ADR_FILE_RE.test(f)).sort();
+        if (!files.length)
+            return fail(`no NNNN-slug.md ADR files in ${dir}`);
+        const sources = files.map((f) => ({ relPath: `${dir}/${f}`, text: readFileSync(join(root, dir, f), "utf8") }));
+        const { decisions, warnings } = mapAdrCorpus(sources);
+        for (const w of warnings)
+            console.log(`  ⚠ ${w}`);
+        // Fail-safe topic anchoring: an import must never create a SECOND live
+        // decision on a topic the graph already anchors — drop the anchor, keep
+        // the record (visible, just not drift-anchored), and say so.
+        const existing = store.recs("decisions").filter((d) => !decisions.some((n) => n.id === d.id));
+        for (const d of decisions) {
+            if (d.status !== "accepted" || !d.topic)
+                continue;
+            if (liveForTopic(existing, d.topic).length) {
+                console.log(`  ⚠ topic ${d.topic} already has a live decision in the graph — importing ${d.id} un-anchored`);
+                d.topic = null;
+            }
+        }
+        if (opts.dryRun) {
+            for (const d of decisions) {
+                const window = d.valid_to ? `${d.valid_from ?? "?"} → ${d.valid_to}` : "in force";
+                console.log(`  ${d.id} [${d.status}] ${d.title} (${window})`);
+            }
+            console.log(`✓ dry run: ${decisions.length} ADR(s) parsed from ${dir}, nothing written`);
+            return;
+        }
+        store.json.ensureDirs();
+        let created = 0, updated = 0;
+        for (const d of decisions) {
+            if (store.getRec("decisions", d.id))
+                updated++;
+            else
+                created++;
+            store.putCapture("decisions", d, opts.private);
+        }
+        store.reindex();
+        const home = store.captureHome(!!opts.private);
+        if (home === "public" && !store.autoCommit)
+            refreshExistingGrounding(root, store);
+        const flush = flushCapture(store, hunchPaths(root).hunch, !!opts.private, `hunch: import ${decisions.length} ADR(s) from ${dir}`);
+        const live = decisions.filter((d) => d.status === "accepted").length;
+        console.log(`✓ imported ${decisions.length} ADR(s) from ${dir} (${created} new, ${updated} updated; ${live} live, ${decisions.length - live} historical)${opts.private ? " [private overlay]" : ""}`);
+        if (flush === "pushed")
+            console.log("  ↳ private memory committed + pushed");
+    }
+    finally {
+        store.close();
+    }
+});
+// ---- export-adr (MADR projection — the MADR bridge, export half) -----------
+program
+    .command("export-adr")
+    .description("Project the PUBLIC decision graph as a regenerated MADR 3.x corpus (a disposable build artifact — the graph stays the source of truth). Only files carrying the hunch:generated marker are ever overwritten.")
+    .argument("[dir]", "output directory (repo-relative)", "docs/adr")
+    .option("--dry-run", "render and report without writing")
+    .action((dirArg, opts) => {
+    const { store, root } = storeFor();
+    try {
+        const dir = toPosixTarget(dirArg);
+        // PUBLIC store only — an exported artifact is committable, so overlay
+        // records must never reach it (one-way privacy boundary).
+        const decisions = store.json.loadAll("decisions");
+        if (!decisions.length)
+            return fail("no public decisions to export");
+        const { files, backstageAnnotation } = exportMadrCorpus(decisions, dir);
+        const outDir = join(root, dir);
+        // The projection owns its directory outright: mixing generated output into
+        // a hand-written ADR corpus would duplicate numbering and corrupt every
+        // MADR reader of that dir. Any non-generated ADR-shaped file → refuse whole.
+        const existingGenerated = new Set();
+        if (existsSync(outDir)) {
+            for (const f of readdirSync(outDir)) {
+                if (!f.endsWith(".md"))
+                    continue;
+                const text = readFileSync(join(outDir, f), "utf8");
+                if (isRegenerableMadr(text))
+                    existingGenerated.add(f);
+                else if (ADR_FILE_RE.test(f)) {
+                    return fail(`${dir} holds a hand-written ADR corpus (${f} has no hunch:generated marker) — export to a different directory (e.g. \`hunch export-adr docs/adr-generated\`), or import it first with \`hunch import-adr ${dir}\``);
+                }
+            }
+        }
+        const stale = [...existingGenerated].filter((f) => !files.some((n) => n.name === f));
+        if (opts.dryRun) {
+            console.log(`✓ dry run: would write ${files.length} ADR(s) to ${dir}${stale.length ? `, remove ${stale.length} stale generated file(s)` : ""}`);
+            return;
+        }
+        mkdirSync(outDir, { recursive: true });
+        for (const f of files)
+            writeFileSync(join(outDir, f.name), f.text);
+        // A regeneration renumbers; previously generated files not in the new set
+        // are OURS (marker-verified) and stale — remove so the corpus stays coherent.
+        for (const f of stale)
+            rmSync(join(outDir, f));
+        // Adopt the corpus: the manifest is what makes `hunch drift` able to notice
+        // this projection going stale, being hand-edited, or outliving its decision.
+        // Written after the files land, so a failed write never claims freshness.
+        writeMadrManifest(root, buildMadrManifest(dir, files, new Date().toISOString()));
+        console.log(`✓ exported ${files.length} ADR(s) to ${dir}${stale.length ? `; removed ${stale.length} stale generated file(s)` : ""}`);
+        console.log(`  ↳ Backstage: add to catalog-info.yaml metadata.annotations →  ${backstageAnnotation}`);
+    }
+    finally {
+        store.close();
+    }
+});
 // ---- record-constraint (human-authored invariant) -------------------------
 program
     .command("record-constraint")
@@ -5103,6 +5243,30 @@ program
                 console.log(`· ${f.id} — ${f.detail}`);
             console.log(`\nHeal: run \`hunch wiki --heal\` — regenerates only the stale pages (the wiki is a derived view; never edit it by hand).\n`);
         }
+        // The MADR projection: three kinds, three different human actions — which is
+        // why they are separate sections rather than one "run export-adr" line.
+        const madrStale = kind("madr-stale");
+        if (madrStale.length) {
+            console.log(`${madrStale.length} exported ADR(s) drifted from the graph:\n`);
+            for (const f of madrStale)
+                console.log(`· ${f.id} — ${f.detail}`);
+            console.log(`\nHeal: run \`hunch export-adr\` — the corpus is a disposable projection (the graph stays the source of truth). Normally this never appears: the projection refreshes automatically on every capture.\n`);
+        }
+        const madrEdited = kind("madr-edited");
+        if (madrEdited.length) {
+            console.log(`${madrEdited.length} generated ADR(s) were hand-edited — the next export would overwrite them:\n`);
+            for (const f of madrEdited)
+                console.log(`· ${f.id} — ${f.detail}`);
+            console.log(`\nHeal A (the DECISION is what changed): move the edit into the decision via /capture, then let the projection regenerate — the edit survives because it now lives in the graph.`);
+            console.log(`Heal B (you want to own this file): delete the hunch:generated marker. The export refuses it from then on and it becomes a hand-written ADR.\n`);
+        }
+        const madrOrphan = kind("madr-orphan");
+        if (madrOrphan.length) {
+            console.log(`${madrOrphan.length} generated ADR(s) have no decision behind them any more:\n`);
+            for (const f of madrOrphan)
+                console.log(`· ${f.id} — ${f.detail}`);
+            console.log(`\nHeal: delete the file, or run \`hunch export-adr\` to regenerate the corpus without it. If the decision moved to the private overlay, the file is a PUBLIC artifact of a now-private record — delete it.\n`);
+        }
         // Every drift kind heals here — see bug_drift_heal_asymmetry above. premise-stale
         // shipped in the drift report without a section here, so a repo whose ONLY drift
         // was a dead premise got "N findings" from `hunch drift` and a bare closing line

package/dist/core/drift.js

@@ -11,6 +11,11 @@
  *                 (hash-compared via .hunch/wiki-manifest.json; only when a wiki
  *                 was adopted — see src/wiki/wiki.ts). Advisory, healed by
  *                 `hunch wiki --heal`, never a gate.
+ *   - madr-*:     the exported MADR corpus drifted from the graph — stale (the
+ *                 decision moved), edited (a human changed a generated file the
+ *                 next export would overwrite), or orphan (the decision left the
+ *                 public graph). Only when a corpus was exported; healed by
+ *                 `hunch export-adr`. See src/integrations/madrManifest.ts.
  */
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -20,6 +25,7 @@ import { evaluatePremises } from "./premises.js";
 import { parseDocAnchors } from "./docanchors.js";
 import { markdownDocs, STALE_MARKER, SRC_REF } from "./docscan.js";
 import { computeWikiDrift } from "../wiki/wiki.js";
+import { computeMadrDrift } from "../integrations/madrManifest.js";
 export function computeDrift(store, root) {
     const findings = [];
     const decisions = store.recs("decisions");
@@ -142,6 +148,12 @@ export function computeDrift(store, root) {
     //    component vanished). Deterministic hash comparison against the manifest;
     //    fires only when a wiki was adopted. Advisory like every other kind here.
     findings.push(...computeWikiDrift(store, root));
+    // 6b. MADR-* — the exported ADR corpus drifted from the graph. PUBLIC decisions
+    //     only: the corpus is a committable artifact, so its freshness must be
+    //     computed from exactly the records allowed to reach it (an overlay record
+    //     leaking into a public drift report is the same class of bug as one
+    //     leaking into the export itself). Fires only where a corpus was exported.
+    findings.push(...computeMadrDrift(store.json.loadAll("decisions"), root));
     // 7. FINDING-STALE — a LIVE finding (observation, no diff) whose anchor evaporated:
     //    an affected file that no longer exists, or a violates_constraint pointing at a
     //    retired/missing rule. Deterministic + advisory (never the exit-code class):

package/dist/extractors/adrImport.js

@@ -0,0 +1,286 @@
+/**
+ * MADR/Nygard ADR corpus import (roadmap: MADR bridge, import half).
+ *
+ * Deterministic, no-LLM: parse an existing `docs/adr`-style corpus into Decision
+ * records so an ADR-practicing repo gets a populated graph on day 1 instead of
+ * waiting for commit backfill. Mapping contract:
+ *   accepted            -> status accepted (live)
+ *   proposed/draft      -> status proposed
+ *   rejected            -> status rejected
+ *   superseded/deprecated -> status superseded, valid_to closed (bi-temporal)
+ *   "Considered Options" minus the chosen one -> alternatives_rejected
+ *   file slug           -> topic `adr.<slug>` (namespaced so an import can never
+ *                          collide with a live hand-captured topic; the CLI still
+ *                          drops the anchor entirely if a collision exists)
+ *   provenance          -> source "imported:madr", the ADR file as evidence
+ *
+ * Ids derive from the ADR's repo-relative path (decisionId("madr:<relPath>")),
+ * so re-importing an updated corpus is an idempotent per-record update, never a
+ * duplicate. Parsing is pure (string in, records out) — the CLI owns all IO.
+ */
+import { decisionId } from "../core/ids.js";
+/** Directories probed (in order) when no explicit dir is given — adr-tools'
+ *  default (doc/adr), MADR's (docs/decisions), and the common variants. */
+export const ADR_DIR_CANDIDATES = [
+    "docs/adr",
+    "docs/decisions",
+    "doc/adr",
+    "adr",
+    "docs/architecture/decisions",
+];
+/** An ADR file is NNNN-slug.md (adr-tools / MADR convention). Templates and
+ *  indexes (adr-template.md, README.md, index.md) never match. */
+export const ADR_FILE_RE = /^(\d{1,5})-([a-z0-9][a-z0-9._-]*)\.md$/i;
+const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+function frontmatterField(fm, key) {
+    const m = new RegExp(`^${key}:[ \\t]*(.+)$`, "mi").exec(fm);
+    if (!m)
+        return null;
+    return m[1].trim().replace(/^["']|["']$/g, "");
+}
+/** Split a markdown body into `## `-heading sections (heading -> body text).
+ *  `###` subsections stay inside their parent's body. */
+function sections(body) {
+    const out = new Map();
+    const lines = body.split(/\r?\n/);
+    let current = null;
+    let buf = [];
+    const flush = () => {
+        if (current !== null)
+            out.set(current.toLowerCase(), buf.join("\n").trim());
+        buf = [];
+    };
+    for (const line of lines) {
+        const h = /^##\s+(.+?)\s*$/.exec(line);
+        if (h && !line.startsWith("###")) {
+            flush();
+            current = h[1];
+        }
+        else if (current !== null) {
+            buf.push(line);
+        }
+    }
+    flush();
+    return out;
+}
+function sectionOf(secs, ...names) {
+    for (const n of names) {
+        const v = secs.get(n.toLowerCase());
+        if (v)
+            return v;
+    }
+    return "";
+}
+/** Top-level `- ` / `* ` list items of a section (MADR "Considered Options"). */
+function listItems(sectionText) {
+    const items = [];
+    for (const line of sectionText.split(/\r?\n/)) {
+        const m = /^[-*]\s+(.+)$/.exec(line.trim());
+        if (m)
+            items.push(stripMdLinks(m[1].trim()));
+    }
+    return items;
+}
+/** Consequences render either as a list or prose paragraphs; normalize to items. */
+function consequenceItems(sectionText) {
+    const items = listItems(sectionText);
+    if (items.length)
+        return items.map((i) => i.replace(/^(good|bad|neutral),\s*(because\s*)?/i, "").trim()).filter(Boolean);
+    const prose = sectionText.trim();
+    return prose ? [stripMdLinks(prose)] : [];
+}
+function stripMdLinks(s) {
+    return s.replace(/\[([^\]]*)\]\([^)]*\)/g, "$1").trim();
+}
+/** ADR cross-reference numbers in a status/frontmatter phrase, e.g.
+ *  "Superseded by [ADR-0007](0007-x.md)" or "supersedes 3". */
+function refNumbers(text) {
+    const out = [];
+    for (const m of text.matchAll(/(?:adr[-\s]?)?0*(\d{1,5})\b/gi))
+        out.push(Number(m[1]));
+    return out;
+}
+function mapStatus(raw) {
+    const s = raw.toLowerCase();
+    if (/supersed|deprecat/.test(s))
+        return "superseded";
+    if (/reject/.test(s))
+        return "rejected";
+    if (/accept|approv/.test(s))
+        return "accepted";
+    return "proposed";
+}
+/** Parse one ADR markdown file (MADR 3.x/4 frontmatter style or Nygard heading
+ *  style). Returns null when the filename doesn't follow NNNN-slug.md. */
+export function parseAdrMarkdown(text, relPath) {
+    const base = relPath.split("/").pop() ?? relPath;
+    const nameMatch = ADR_FILE_RE.exec(base);
+    if (!nameMatch)
+        return null;
+    const number = Number(nameMatch[1]);
+    const slug = nameMatch[2].toLowerCase();
+    const fmMatch = FRONTMATTER_RE.exec(text);
+    const fm = fmMatch ? fmMatch[1] : "";
+    const body = fmMatch ? text.slice(fmMatch[0].length) : text;
+    const titleMatch = /^#\s+(.+?)\s*$/m.exec(body);
+    // Nygard titles carry the number ("1. Record architecture decisions") — strip it.
+    const title = (titleMatch ? titleMatch[1] : slug.replace(/[-_]/g, " ")).replace(/^\d+\.\s*/, "").trim();
+    const secs = sections(body);
+    const statusSection = sectionOf(secs, "Status");
+    const statusRaw = frontmatterField(fm, "status") ?? statusSection.split(/\r?\n/).map((l) => l.trim()).filter(Boolean)[0] ?? "";
+    const status = mapStatus(statusRaw);
+    const date = frontmatterField(fm, "date");
+    // Cross-links live in the status phrase(s) and frontmatter supersede fields.
+    const statusText = `${statusRaw}\n${statusSection}`;
+    const supersededByNumbers = [];
+    const supersedesNumbers = [];
+    for (const line of statusText.split(/\r?\n/)) {
+        if (/superseded\s+by|deprecated\s+by|replaced\s+by/i.test(line))
+            supersededByNumbers.push(...refNumbers(line.replace(/.*?(?:by)/i, "")));
+        else if (/supersedes|replaces/i.test(line))
+            supersedesNumbers.push(...refNumbers(line.replace(/.*?(?:supersedes|replaces)/i, "")));
+    }
+    for (const key of ["superseded-by", "superseded_by"]) {
+        const v = frontmatterField(fm, key);
+        if (v)
+            supersededByNumbers.push(...refNumbers(v));
+    }
+    const fmSupersedes = frontmatterField(fm, "supersedes");
+    if (fmSupersedes)
+        supersedesNumbers.push(...refNumbers(fmSupersedes));
+    const decisionOutcome = sectionOf(secs, "Decision Outcome", "Decision");
+    const chosenMatch = /chosen option:\s*["“]?([^"”\n,]+)["”]?/i.exec(decisionOutcome);
+    const consideredOptions = listItems(sectionOf(secs, "Considered Options", "Options"));
+    // "### Consequences" nests inside Decision Outcome in MADR; Nygard has it top-level.
+    let consequencesText = sectionOf(secs, "Consequences");
+    if (!consequencesText) {
+        const nested = /###\s+Consequences\s*\r?\n([\s\S]*?)(?=\r?\n###\s|$)/i.exec(decisionOutcome);
+        if (nested)
+            consequencesText = nested[1].trim();
+    }
+    return {
+        relPath,
+        number,
+        slug,
+        title,
+        statusRaw,
+        status,
+        date,
+        context: stripMdLinks(sectionOf(secs, "Context and Problem Statement", "Context")).trim(),
+        decision: stripMdLinks(decisionOutcome.replace(/###\s+Consequences[\s\S]*$/i, "")).trim(),
+        consequences: consequenceItems(consequencesText),
+        consideredOptions,
+        chosenOption: chosenMatch ? chosenMatch[1].trim() : null,
+        supersedesNumbers: [...new Set(supersedesNumbers)],
+        supersededByNumbers: [...new Set(supersededByNumbers)],
+    };
+}
+export function adrDecisionId(relPath) {
+    return decisionId(`madr:${relPath}`);
+}
+/** Map a parsed corpus to Decision records. Pure: cross-links resolve by ADR
+ *  number WITHIN the given corpus only; unresolvable references become warnings,
+ *  never guessed ids. Bi-temporal closure: a superseded ADR's valid_to is its
+ *  successor's valid_from (falling back to the successor's date, then its own
+ *  date) so as-of queries see the corpus's real history. */
+export function mapAdrCorpus(sources) {
+    const warnings = [];
+    const parsed = [];
+    for (const src of sources) {
+        const p = parseAdrMarkdown(src.text, src.relPath);
+        if (!p) {
+            warnings.push(`${src.relPath}: filename does not follow NNNN-slug.md — skipped`);
+            continue;
+        }
+        parsed.push(p);
+    }
+    const byNumber = new Map();
+    for (const p of parsed) {
+        if (byNumber.has(p.number))
+            warnings.push(`duplicate ADR number ${p.number}: ${byNumber.get(p.number).relPath} and ${p.relPath} — cross-links resolve to the first`);
+        else
+            byNumber.set(p.number, p);
+    }
+    // Derive the missing half of each supersede link so a one-sided "Superseded by"
+    // still closes windows and sets both pointers.
+    for (const p of parsed) {
+        for (const n of p.supersedesNumbers) {
+            const target = byNumber.get(n);
+            if (!target) {
+                warnings.push(`${p.relPath}: supersedes ADR ${n}, which is not in the corpus`);
+                continue;
+            }
+            if (!target.supersededByNumbers.includes(p.number))
+                target.supersededByNumbers.push(p.number);
+        }
+        for (const n of p.supersededByNumbers) {
+            const successor = byNumber.get(n);
+            if (!successor) {
+                warnings.push(`${p.relPath}: superseded by ADR ${n}, which is not in the corpus`);
+                continue;
+            }
+            if (!successor.supersedesNumbers.includes(p.number))
+                successor.supersedesNumbers.push(p.number);
+        }
+    }
+    const decisions = parsed.map((p) => {
+        const successor = p.supersededByNumbers.map((n) => byNumber.get(n)).find(Boolean) ?? null;
+        const superseded = p.status === "superseded" || !!successor;
+        const validTo = superseded ? (successor?.date ?? p.date) : null;
+        const alternatives = p.consideredOptions.filter((o) => !p.chosenOption || o.toLowerCase() !== p.chosenOption.toLowerCase());
+        return {
+            id: adrDecisionId(p.relPath),
+            title: p.title,
+            topic: `adr.${p.slug}`,
+            status: superseded ? "superseded" : p.status,
+            context: p.context,
+            decision: p.decision || p.title,
+            consequences: p.consequences,
+            alternatives_rejected: alternatives,
+            rejected_tripwires: [],
+            related_components: [],
+            related_files: [p.relPath],
+            supersedes: p.supersedesNumbers.map((n) => byNumber.get(n)).filter(Boolean).map((t) => adrDecisionId(t.relPath))[0] ?? null,
+            superseded_by: successor ? adrDecisionId(successor.relPath) : null,
+            caused_by_bug: null,
+            commit: null,
+            valid_from: p.date ?? undefined,
+            valid_to: validTo,
+            retired: { symbols: [], deps: [] },
+            provenance: {
+                source: "imported:madr",
+                confidence: 0.75,
+                evidence: [p.relPath, `status: ${p.statusRaw || "(none)"}`],
+            },
+            date: p.date ?? new Date().toISOString(),
+        };
+    });
+    // A corpus must not import two LIVE decisions onto one topic (the store-wide
+    // one-live-per-topic invariant): keep the highest ADR number live, close the rest.
+    const liveByTopic = new Map();
+    for (const d of decisions) {
+        if (d.status === "accepted" && d.topic) {
+            const list = liveByTopic.get(d.topic) ?? [];
+            list.push(d);
+            liveByTopic.set(d.topic, list);
+        }
+    }
+    for (const [topic, list] of liveByTopic) {
+        if (list.length < 2)
+            continue;
+        list.sort((a, b) => adrNumberOf(a, parsed) - adrNumberOf(b, parsed));
+        const winner = list[list.length - 1];
+        for (const loser of list.slice(0, -1)) {
+            loser.status = "superseded";
+            loser.superseded_by = winner.id;
+            loser.valid_to = winner.valid_from ?? loser.date;
+            warnings.push(`topic ${topic}: two live ADRs — kept ${winner.id} live, closed ${loser.id}`);
+        }
+    }
+    return { decisions, warnings };
+}
+function adrNumberOf(d, parsed) {
+    const rel = d.related_files[0];
+    return parsed.find((p) => p.relPath === rel)?.number ?? 0;
+}
+//# sourceMappingURL=adrImport.js.map

package/dist/integrations/madrExport.js

@@ -0,0 +1,109 @@
+export const MADR_EXPORT_MARKER = "<!-- hunch:generated madr-export — regenerated by `hunch export-adr`; edits will be overwritten -->";
+function slugify(title) {
+    const s = title
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 60)
+        .replace(/-+$/, "");
+    return s || "decision";
+}
+function statusLine(d, nameOf) {
+    if (d.status === "superseded") {
+        const successor = d.superseded_by ? nameOf.get(d.superseded_by) : null;
+        return successor ? `superseded by [${successor}](${successor})` : "superseded";
+    }
+    return d.status;
+}
+/** Render one decision as a MADR 3.x document. Deterministic: content depends
+ *  only on the decision record and the corpus's name map. */
+export function renderMadr(d, nameOf) {
+    const lines = [];
+    lines.push("---");
+    lines.push(`status: ${statusLine(d, nameOf)}`);
+    const date = (d.valid_from ?? d.date).slice(0, 10);
+    lines.push(`date: ${date}`);
+    lines.push("---");
+    lines.push("");
+    lines.push(MADR_EXPORT_MARKER);
+    lines.push("");
+    lines.push(`# ${d.title}`);
+    if (d.context) {
+        lines.push("");
+        lines.push("## Context and Problem Statement");
+        lines.push("");
+        lines.push(d.context);
+    }
+    if (d.alternatives_rejected.length) {
+        lines.push("");
+        lines.push("## Considered Options");
+        lines.push("");
+        lines.push(`- ${d.title}`);
+        for (const alt of d.alternatives_rejected)
+            lines.push(`- ${alt}`);
+    }
+    lines.push("");
+    lines.push("## Decision Outcome");
+    lines.push("");
+    // Canonical MADR phrasing so the projection round-trips through import-adr:
+    // the "Chosen option:" line is what marks the winner among Considered Options.
+    if (d.alternatives_rejected.length) {
+        lines.push(`Chosen option: "${d.title}", because of the following.`);
+        if (d.decision) {
+            lines.push("");
+            lines.push(d.decision);
+        }
+    }
+    else {
+        lines.push(d.decision || d.title);
+    }
+    if (d.supersedes && nameOf.get(d.supersedes)) {
+        lines.push("");
+        lines.push(`Supersedes [${nameOf.get(d.supersedes)}](${nameOf.get(d.supersedes)}).`);
+    }
+    if (d.consequences.length) {
+        lines.push("");
+        lines.push("### Consequences");
+        lines.push("");
+        for (const c of d.consequences)
+            lines.push(`- ${c}`);
+    }
+    lines.push("");
+    lines.push(`<!-- source: ${d.id}${d.commit ? ` @ ${d.commit}` : ""} -->`);
+    lines.push("");
+    return lines.join("\n");
+}
+/** Project a PUBLIC decision list into a MADR corpus. Numbering is date order
+ *  (valid_from, then date, then id for determinism) and assigned per export —
+ *  the projection is disposable, links inside it are internally consistent. */
+export function exportMadrCorpus(decisions, dirForAnnotation) {
+    const sorted = [...decisions].sort((a, b) => {
+        const ka = `${a.valid_from ?? a.valid_to ?? a.date} ${a.valid_to ? 0 : 1} ${a.id}`;
+        const kb = `${b.valid_from ?? b.valid_to ?? b.date} ${b.valid_to ? 0 : 1} ${b.id}`;
+        return ka < kb ? -1 : ka > kb ? 1 : 0;
+    });
+    const nameOf = new Map();
+    const taken = new Set();
+    sorted.forEach((d, i) => {
+        let slug = slugify(d.title);
+        while (taken.has(slug))
+            slug = `${slug}-${d.id.slice(4, 10)}`;
+        taken.add(slug);
+        nameOf.set(d.id, `${String(i + 1).padStart(4, "0")}-${slug}.md`);
+    });
+    const files = sorted.map((d) => ({
+        name: nameOf.get(d.id),
+        text: renderMadr(d, nameOf),
+        decisionId: d.id,
+    }));
+    return {
+        files,
+        backstageAnnotation: `backstage.io/adr-location: ${dirForAnnotation}`,
+    };
+}
+/** True when an existing file may be overwritten by the export: only our own
+ *  generated output ever qualifies. */
+export function isRegenerableMadr(existingText) {
+    return existingText.includes(MADR_EXPORT_MARKER);
+}
+//# sourceMappingURL=madrExport.js.map

package/dist/integrations/madrManifest.js

@@ -0,0 +1,251 @@
+/**
+ * MADR projection freshness — the manifest and the drift it feeds.
+ *
+ * The export half (madrExport.ts) renders the graph into a disposable MADR
+ * corpus. Nothing, until now, noticed when that corpus went stale: the wiki gets
+ * `wiki-stale` when its inputs move, but an exported ADR file could sit in
+ * `docs/adr/` confidently wrong forever. This closes that seam with the exact
+ * mechanism the wiki already proves out — a content-hash manifest, adopted on
+ * first export, silent when absent.
+ *
+ * Two hashes per file, and they answer different questions:
+ *   - `hash`  — the decision's projected content. Moves when the GRAPH moves,
+ *               so a mismatch means "the projection is behind the graph".
+ *   - `bytes` — the file as written. Moves when a HUMAN edits it, so a mismatch
+ *               means "someone hand-edited a generated file", which the export
+ *               marker warns against but nothing detected.
+ *
+ * Three findings, matching the three ways a projection can rot:
+ *   - madr-stale    the decision changed since export (or the file is gone)
+ *   - madr-edited   a generated file was hand-edited; the next export overwrites it
+ *   - madr-orphan   a generated file whose decision no longer exists in the graph
+ *
+ * All advisory, like every other drift kind: this is a smoke detector, not a
+ * robot that rewrites the corpus. `hunch export-adr` is the heal.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { writeFileAtomic } from "../core/io.js";
+import { hunchPaths } from "../core/paths.js";
+import { toPosixTarget } from "../core/paths.js";
+import { exportMadrCorpus, isRegenerableMadr } from "./madrExport.js";
+const sha16 = (s) => createHash("sha256").update(s).digest("hex").slice(0, 16);
+export function madrManifestPath(root) {
+    return join(hunchPaths(root).hunch, "madr-manifest.json");
+}
+export function readMadrManifest(root) {
+    try {
+        const raw = JSON.parse(readFileSync(madrManifestPath(root), "utf8"));
+        if (!raw || raw.version !== 1 || typeof raw.dir !== "string" || !raw.files || typeof raw.files !== "object")
+            return null;
+        // Drop malformed entries rather than crashing every drift-bearing command,
+        // the same tolerance readWikiManifestAt applies to a bad merge.
+        raw.files = Object.fromEntries(Object.entries(raw.files).filter(([, f]) => f && typeof f === "object" && typeof f.decision === "string" && typeof f.hash === "string"));
+        return raw;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeMadrManifest(root, manifest) {
+    writeFileAtomic(madrManifestPath(root), JSON.stringify(manifest, null, 2) + "\n");
+}
+/** The projected-content hash for one file. Content, not mtime: a re-export that
+ *  changes nothing must not read as drift. */
+export const madrContentHash = (text) => sha16(text);
+/**
+ * Build the manifest for a corpus that was just written.
+ *
+ * `written` carries the bytes actually placed on disk, which may differ from the
+ * rendered text when a file was refused (hand-written corpus in the target dir).
+ * Refused files are absent from the manifest, so they are never later reported
+ * as edited — they were never ours.
+ */
+export function buildMadrManifest(dir, entries, generatedAt) {
+    const files = {};
+    for (const e of entries) {
+        files[e.name] = {
+            decision: e.decisionId,
+            hash: madrContentHash(e.text),
+            bytes: sha16(e.text),
+            generated: generatedAt,
+        };
+    }
+    return { version: 1, dir: toPosixTarget(dir), files };
+}
+/**
+ * Drift for the MADR projection. Fires ONLY where a manifest exists — a repo that
+ * never ran `hunch export-adr` sees zero noise, matching the wiki's rule.
+ *
+ * Takes the PUBLIC decision list, never the overlay union: the projection is a
+ * committable artifact, so its freshness must be computed from exactly the
+ * records that are allowed to reach it. Passing the union here would leak the
+ * existence of overlay decisions into a public drift report.
+ */
+export function computeMadrDrift(publicDecisions, root) {
+    const manifest = readMadrManifest(root);
+    if (!manifest)
+        return []; // never exported → silent
+    const findings = [];
+    // Re-render from the current graph. Numbering is assigned per export, so a file
+    // name is only stable while the decision set is; compare by DECISION id, which
+    // is the thing that actually has identity.
+    const { files } = exportMadrCorpus(publicDecisions, manifest.dir);
+    const currentByDecision = new Map(files.map((f) => [f.decisionId, f]));
+    const liveIds = new Set(publicDecisions.map((d) => d.id));
+    for (const [name, entry] of Object.entries(manifest.files)) {
+        const rel = `${manifest.dir}/${name}`;
+        const abs = join(root, manifest.dir, name);
+        // 1. ORPHAN — the decision left the public graph (deleted, or moved to the
+        //    overlay). The file is now a public artifact with no record behind it,
+        //    which is the shape of a leak as much as of staleness.
+        if (!liveIds.has(entry.decision)) {
+            findings.push({
+                kind: "madr-orphan",
+                id: rel,
+                detail: `generated ADR has no decision in the public graph (${entry.decision} is gone or moved to the overlay) — delete it, or re-run \`hunch export-adr\``,
+            });
+            continue;
+        }
+        // 2. MISSING — manifested but not on disk.
+        if (!existsSync(abs)) {
+            findings.push({
+                kind: "madr-stale",
+                id: rel,
+                detail: `generated ADR for ${entry.decision} is missing from ${manifest.dir}/ — regenerate with \`hunch export-adr\``,
+            });
+            continue;
+        }
+        let onDisk;
+        try {
+            onDisk = readFileSync(abs, "utf8");
+        }
+        catch {
+            continue; // unreadable is an environment problem, not memory drift
+        }
+        // 3. HAND-EDITED — the bytes moved and the marker is still there, so the next
+        //    export silently overwrites human work. Report before that happens.
+        //    A file whose marker was REMOVED is deliberately not ours any more: the
+        //    export already refuses it, and calling that drift would nag forever.
+        if (sha16(onDisk) !== entry.bytes && isRegenerableMadr(onDisk)) {
+            findings.push({
+                kind: "madr-edited",
+                id: rel,
+                detail: `generated ADR was hand-edited — \`hunch export-adr\` will overwrite it. Move the change into decision ${entry.decision} (\`/capture\`), or drop the hunch:generated marker to adopt the file`,
+            });
+        }
+        // 4. STALE — the graph moved underneath the projection.
+        const current = currentByDecision.get(entry.decision);
+        if (current && madrContentHash(current.text) !== entry.hash) {
+            findings.push({
+                kind: "madr-stale",
+                id: rel,
+                detail: `decision ${entry.decision} changed since export — regenerate with \`hunch export-adr\``,
+            });
+        }
+    }
+    // 5. UNEXPORTED — a public decision with no file at all. Only reported once a
+    //    corpus exists, so adopting the export does not immediately indict every
+    //    decision recorded before it.
+    const manifested = new Set(Object.values(manifest.files).map((f) => f.decision));
+    const missing = publicDecisions.filter((d) => !manifested.has(d.id));
+    if (missing.length) {
+        findings.push({
+            kind: "madr-stale",
+            id: manifest.dir,
+            detail: `${missing.length} public decision(s) have no ADR in ${manifest.dir}/ (e.g. ${missing[0].id}) — regenerate with \`hunch export-adr\``,
+        });
+    }
+    return findings;
+}
+export function refreshMadrCorpus(publicDecisions, root, now) {
+    const manifest = readMadrManifest(root);
+    if (!manifest)
+        return null; // never adopted → stay out of the way
+    const { files } = exportMadrCorpus(publicDecisions, manifest.dir);
+    const outDir = join(root, manifest.dir);
+    if (!existsSync(outDir))
+        return null; // corpus deleted wholesale; drift reports it
+    const skippedEdited = [];
+    const kept = [];
+    /** Manifest entries carried through verbatim (hand-edited files we refused to touch). */
+    const preserved = new Map();
+    let written = 0;
+    // Edit detection is keyed by CONTENT, not by file name. Numbering is assigned
+    // per export, so adding one decision shifts every later file to a new name —
+    // a name-keyed check then finds no prior entry for the shifted name, calls the
+    // hand-edited file at that path "stale", and overwrites it (and the removal
+    // sweep would delete it under its old name). Bytes we have ever written are
+    // exactly the manifest's `bytes` values: an on-disk generated file whose hash
+    // is not among them was edited by a human, whatever it is currently called.
+    const knownBytes = new Set(Object.values(manifest.files).map((entry) => entry.bytes));
+    for (const f of files) {
+        const abs = join(outDir, f.name);
+        const prior = manifest.files[f.name];
+        if (existsSync(abs)) {
+            let onDisk;
+            try {
+                onDisk = readFileSync(abs, "utf8");
+            }
+            catch {
+                continue;
+            }
+            // Someone else's file: leave it alone (its decision then surfaces as
+            // "no ADR" drift rather than being silently unrepresented).
+            if (!isRegenerableMadr(onDisk))
+                continue;
+            if (onDisk === f.text) {
+                kept.push(f);
+                continue; // already current — no write, no churn
+            }
+            const bytes = sha16(onDisk);
+            const edited = prior ? bytes !== prior.bytes : !knownBytes.has(bytes);
+            if (edited) {
+                skippedEdited.push(f.name);
+                // Carry the PRIOR entry through untouched (when one exists). Rebuilding
+                // it from the edited bytes would make the file match its own manifest
+                // and the edit would stop being reported — the refresh would quietly
+                // launder a hand edit into the record of what we generated.
+                if (prior)
+                    preserved.set(f.name, prior);
+                continue;
+            }
+        }
+        writeFileAtomic(abs, f.text);
+        kept.push(f);
+        written++;
+    }
+    // Drop generated files the new numbering no longer produces — but ONLY files
+    // whose bytes we wrote. An edited file under its old name is preserved (with
+    // its manifest entry, so madr-edited keeps firing) rather than deleted: this
+    // sweep was the second way a renumbering could destroy a human's edit.
+    let removed = 0;
+    const produced = new Set(files.map((f) => f.name));
+    for (const name of Object.keys(manifest.files)) {
+        if (produced.has(name))
+            continue;
+        const abs = join(outDir, name);
+        if (!existsSync(abs))
+            continue;
+        try {
+            const onDisk = readFileSync(abs, "utf8");
+            if (!isRegenerableMadr(onDisk))
+                continue;
+            if (!knownBytes.has(sha16(onDisk))) {
+                skippedEdited.push(name);
+                preserved.set(name, manifest.files[name]);
+                continue;
+            }
+            rmSync(abs);
+            removed++;
+        }
+        catch { /* best effort */ }
+    }
+    const next = buildMadrManifest(manifest.dir, kept, now);
+    for (const [name, entry] of preserved)
+        next.files[name] = entry;
+    writeMadrManifest(root, next);
+    return { dir: manifest.dir, written, removed, skippedEdited };
+}
+//# sourceMappingURL=madrManifest.js.map

package/dist/store/hunchStore.js

@@ -592,7 +592,11 @@ export class HunchStore {
             }
             // w > 1 (a trigger match) shifts UP, w < 1 shifts DOWN, both clamped.
             const shift = Math.max(-MAX_PRIOR_SHIFT, Math.min(MAX_PRIOR_SHIFT, (1 - w) * PRIOR_SHIFT_SCALE));
-            return { h, pos: pos + shift };
+            // Recorded intent outranks code that merely shares the query's vocabulary. Applied
+            // OUTSIDE the clamp above: that bound keeps the trust dimmer from becoming the sort
+            // key, whereas this is a kind-level tie-break between two different answer types.
+            const memory = MEMORY_KINDS.has(h.kind) ? -MEMORY_PRIOR_SHIFT : 0;
+            return { h, pos: pos + shift + memory };
         });
         scored.sort((a, b) => a.pos - b.pos);
         return scored.slice(0, limit).map((x) => x.h);
@@ -1643,6 +1647,18 @@ const GRAPH_TOKEN_CAP = boundedWhole(numEnv("HUNCH_GRAPH_TOKEN_CAP", 2_000), 2_0
  *  rerankByPriors for the measurement that fixed it at 4. */
 const PRIOR_SHIFT_SCALE = numEnv("HUNCH_PRIOR_SHIFT_SCALE", 12);
 const MAX_PRIOR_SHIFT = numEnv("HUNCH_MAX_PRIOR_SHIFT", 4);
+/** Memory-record prior: a "why" question is answered by RECORDED INTENT (decisions,
+ *  constraints, bugs, runbooks, policies), not by the code symbols that merely share
+ *  its vocabulary. Symbols carry a neutral prior (priorMeta -> null), so on a graph
+ *  with thousands of indexed symbols a lexical tie let them occupy the whole top-k
+ *  and bury the one live decision — including a topic-chain successor that promotion
+ *  had correctly injected just below the cut line. This lifts memory records by a
+ *  bounded number of positions; it never EXCLUDES a kind (a symbol-name query still
+ *  returns symbols, and a constraint stays reachable), it only breaks the tie toward
+ *  intent. Measured on bench/golden-retrieval.json: Recall@10 70% -> 90%, MRR
+ *  0.402 -> 0.575. Set HUNCH_MEMORY_PRIOR_SHIFT=0 to disable. */
+const MEMORY_PRIOR_SHIFT = numEnv("HUNCH_MEMORY_PRIOR_SHIFT", 12);
+const MEMORY_KINDS = new Set(["decisions", "constraints", "bugs", "runbooks", "policies"]);
 function numEnv(name, dflt) {
     const v = Number(process.env[name]);
     // >= 0, not > 0: zero is the documented kill-switch (HUNCH_RRF_W_*=0 disables

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.15.0",
+  "version": "1.17.0",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://hunch-pi.vercel.app",
-  "version": "1.15.0",
+  "version": "1.17.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.15.0",
+      "version": "1.17.0",
       "runtimeHint": "npx",
       "packageArguments": [
         {