@davesheffer/hunch 1.32.0 → 1.32.1

package/README.md

@@ -59,7 +59,7 @@ hunch integrations check --harness claude --probe --require mcp
 hunch integrations check --harness codex --require context,edit-blocking
 ```
 
-Capabilities are reported as **verified**, **advisory-only**, **unsupported** or **untested**. `--require` fails unless every named capability is verified.
+Capabilities are reported as **verified**, **advisory-only**, **unsupported** or **untested**. `--require` fails unless every named capability is verified. `mcp` is verified by a fresh-server probe; hook capabilities become verified only from lifecycle events actually delivered to Hunch's hook on the expected version within the last 30 days (machine-local evidence, the same trust level as the served ledger), so a repository whose agent has actually run shows it, and one that only has configuration does not.
 
 The Codex integration currently supplies MCP and instructions, with no native lifecycle adapter. The opt-in `--probe` verifies a fresh MCP process, not whether an existing host session or model actually followed the memory.
 

package/dist/cli/index.js

@@ -83,6 +83,7 @@ import { recordServed, servedSummary } from "../core/served.js";
 import { recordTaskDelivery, reportActivity } from "../core/taskReport.js";
 import { snapshotDeliveredRecords } from "../core/taskReportEvidence.js";
 import { hookReportTaskId, startHookReport, stopHookReport, observeHookDenial } from "../core/taskReportHook.js";
+import { recordHookObservation } from "../core/hookObservations.js";
 import { contextHookOutput, denyHookOutput, hookProvider, normalizeHookEvent, stopHookOutput } from "../core/agenthook.js";
 import { PIPELINE_LOOP, armExecutionObligations, beforeEditProbeVerdict, compileExecutableProbes, environmentExecutableProbes, environmentExecutionObligations, executionObligationBrief, isProductPath, loadPipelineState, onCommand, onEdit, onPrompt, onSkill, pipelineEnabled, proofCheckpoint, savePipelineState, stopVerdict, unverifiedNag, } from "../core/pipeline.js";
 import { draftDuplicateOf, isAcceptedDuplicateAnchor } from "../core/dupdetect.js";
@@ -4471,6 +4472,9 @@ program
         if (!evt)
             return;
         const root = findRoot();
+        // The host delivered this event: runtime evidence for `hunch integrations check`,
+        // recorded before any policy decision so firmness never hides delivery itself.
+        recordHookObservation(root, provider, evt.hook_event_name);
         const paths = hunchPaths(root);
         const firmness = readConfig(paths).firmness;
         if (firmness === "off")

package/dist/cli/taskReport.js

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { findRoot } from "../core/paths.js";
 import { writeFileAtomic } from "../core/io.js";
 import { finishReportTask, forgetReportTask, listReportTasks, pruneReportHistory, readTaskReport, readLessonHistory, startReportTask } from "../core/taskReport.js";
-import { reportSourceSnapshot, runReportCheck, runReportConformance } from "../core/taskReportEvidence.js";
+import { DEFAULT_CHECK_TIMEOUT_MS, MAX_CHECK_TIMEOUT_MS, reportSourceSnapshot, runReportCheck, runReportConformance } from "../core/taskReportEvidence.js";
 import { renderTaskReport, writeTaskReportHtml } from "../core/taskReportRender.js";
 import { assertReportPath } from "../core/taskReportPaths.js";
 import { publicTaskReport } from "../core/taskReportPublic.js";
@@ -59,8 +59,12 @@ export function registerTaskReportCommands(program, openStore) {
     });
     task.command("verify <id> <command...>").description("Explicitly run a verification command and retain its result/hash, never raw output; use -- before the command")
         .option("--label <label>", "short name of the check", "Verification command")
+        .option("--timeout <seconds>", `seconds before the command tree is stopped and recorded as timed out (max ${MAX_CHECK_TIMEOUT_MS / 1000})`, String(DEFAULT_CHECK_TIMEOUT_MS / 1000))
         .option("--json", "emit only the result JSON, suppressing live command output")
         .action(async (id, command, opts) => {
+        const seconds = Number(opts.timeout);
+        if (!Number.isInteger(seconds) || seconds < 1 || seconds * 1000 > MAX_CHECK_TIMEOUT_MS)
+            throw new Error(`--timeout must be a whole number of seconds between 1 and ${MAX_CHECK_TIMEOUT_MS / 1000}`);
         const controller = new AbortController();
         let signalExit = 0;
         const interrupt = () => { signalExit = 130; controller.abort(); };
@@ -68,7 +72,7 @@ export function registerTaskReportCommands(program, openStore) {
         process.on("SIGINT", interrupt);
         process.on("SIGTERM", terminate);
         try {
-            const result = await runReportCheck(findRoot(), id, command, opts.label, 120_000, {
+            const result = await runReportCheck(findRoot(), id, command, opts.label, seconds * 1000, {
                 signal: controller.signal,
                 onStdout: opts.json ? undefined : chunk => { process.stdout.write(chunk); },
                 onStderr: opts.json ? undefined : chunk => { process.stderr.write(chunk); },

package/dist/core/hookObservations.d.ts

@@ -0,0 +1,9 @@
+export interface HookObservation {
+    provider: string;
+    event: string;
+    at: string;
+    version: string;
+}
+/** Never throws (con_03a0b94b2e): a missing ledger costs evidence, not the edit. */
+export declare function recordHookObservation(root: string, provider: string, event: string): void;
+export declare function readHookObservations(root: string): HookObservation[];

package/dist/core/hookObservations.js

@@ -0,0 +1,33 @@
+/** Runtime evidence that a host actually delivered a lifecycle event to Hunch's
+ * hook. Configuration proves wiring; only an observed event proves delivery.
+ * One row per (provider, normalized event), machine-local, outside the
+ * rebuildable index. Recording is best-effort: a hook must never fail on it. */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { withServedDatabase } from "./served.js";
+import { HUNCH_VERSION } from "./version.js";
+function ensureTable(db) {
+    db.exec(`CREATE TABLE IF NOT EXISTS hook_observations (
+    provider TEXT NOT NULL, event TEXT NOT NULL, at TEXT NOT NULL, version TEXT NOT NULL,
+    PRIMARY KEY (provider, event)
+  )`);
+}
+/** Never throws (con_03a0b94b2e): a missing ledger costs evidence, not the edit. */
+export function recordHookObservation(root, provider, event) {
+    try {
+        withServedDatabase(root, db => {
+            ensureTable(db);
+            db.prepare("INSERT OR REPLACE INTO hook_observations VALUES (?, ?, ?, ?)").run(provider, event, new Date().toISOString(), HUNCH_VERSION);
+        });
+    }
+    catch { /* evidence is optional; the hook response is not */ }
+}
+export function readHookObservations(root) {
+    if (!existsSync(join(root, ".hunch-cache", "served.db")))
+        return [];
+    return withServedDatabase(root, db => {
+        ensureTable(db);
+        return db.prepare("SELECT provider, event, at, version FROM hook_observations ORDER BY at DESC").all();
+    });
+}
+//# sourceMappingURL=hookObservations.js.map

package/dist/core/taskReportEvidence.d.ts

@@ -17,6 +17,8 @@ export declare function reportSourceSnapshot(root: string): ReportSnapshot;
  * predicate's subject lives in a changed file. Everything else stays
  * `not-exercised` or `unavailable` — never "satisfied" by file overlap. */
 export declare function runReportConformance(root: string, store: HunchStore, taskId: string): ReportConformance[];
+export declare const DEFAULT_CHECK_TIMEOUT_MS = 120000;
+export declare const MAX_CHECK_TIMEOUT_MS: number;
 /** A deliberately explicit command wrapper. The caller chooses the command;
  * reports never execute commands automatically to validate submitted claims. */
 export declare function runReportCheck(root: string, taskId: string, command: string[], label: string, timeoutMs?: number, options?: {

package/dist/core/taskReportEvidence.js

@@ -190,11 +190,15 @@ export function runReportConformance(root, store, taskId) {
         return value;
     });
 }
+export const DEFAULT_CHECK_TIMEOUT_MS = 120_000;
+export const MAX_CHECK_TIMEOUT_MS = 6 * 60 * 60_000;
 /** A deliberately explicit command wrapper. The caller chooses the command;
  * reports never execute commands automatically to validate submitted claims. */
 export async function runReportCheck(root, taskId, command, label, timeoutMs = 120_000, options = {}) {
-    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 600_000)
-        throw new Error("verification timeout must be between 1 and 600000 ms");
+    // A full suite can legitimately run for half an hour (fnd_70dd5c4034); the
+    // bound exists so an abandoned runner cannot hold a task open indefinitely.
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_CHECK_TIMEOUT_MS)
+        throw new Error(`verification timeout must be between 1 and ${MAX_CHECK_TIMEOUT_MS} ms`);
     options.signal?.throwIfAborted();
     const task = readTaskReport(root, taskId).task;
     if (task.state !== "open")

package/dist/integrations/health.js

@@ -8,6 +8,15 @@ import { writeFileAtomic } from "../core/io.js";
 import { HUNCH_VERSION } from "../core/version.js";
 import { readConfig } from "../core/config.js";
 import { hunchPaths } from "../core/paths.js";
+import { readHookObservations } from "../core/hookObservations.js";
+/** Normalized hook events that prove each capability was delivered by the host. */
+const CAPABILITY_EVIDENCE = {
+    context: ["SessionStart", "UserPromptSubmit"],
+    "edit-blocking": ["PreToolUse"],
+    "failure-capture": ["PostToolUseFailure", "PostToolUse"],
+    compaction: ["PreCompact"],
+};
+const OBSERVATION_FRESH_MS = 30 * 86_400_000;
 export const CAPABILITIES = ["mcp", "context", "edit-blocking", "failure-capture", "compaction"];
 export const HARNESSES = {
     claude: { mcp: ".mcp.json", hooks: ".claude/settings.json", key: "mcpServers", events: ["SessionStart", "PreToolUse", "PostToolUseFailure", "PreCompact"] },
@@ -112,6 +121,14 @@ export function inspectIntegrations(root, selected) {
             }
         }
     };
+    // Machine-local runtime evidence; an unreadable ledger simply leaves hooks untested.
+    let observed = [];
+    try {
+        observed = readHookObservations(root);
+    }
+    catch {
+        observed = [];
+    }
     for (const harness of selected ? [selected] : Object.keys(HARNESSES)) {
         const spec = HARNESSES[harness];
         if (!selected && !existsSync(join(root, spec.mcp)) && (!spec.hooks || !existsSync(join(root, spec.hooks))))
@@ -163,7 +180,20 @@ export function inspectIntegrations(root, selected) {
                 status.detail = `firmness=${firmness}; edits are not blocked`;
             }
             else {
-                status.detail = `${event} configured; host delivery, matchers, and tool coverage are not verified`;
+                // Verified only by an event the host actually delivered, on the expected
+                // version, recently. Matchers and tool coverage beyond that event stay unproven.
+                const hit = observed.find(o => o.provider === harness && CAPABILITY_EVIDENCE[capability].includes(o.event));
+                const fresh = hit !== undefined && Date.now() - Date.parse(hit.at) <= OBSERVATION_FRESH_MS;
+                if (hit && fresh && hit.version === report.expectedVersion) {
+                    status.status = "verified";
+                    status.detail = `${hit.event} observed from the ${harness} host at ${hit.at} on Hunch ${hit.version}; matchers and tool coverage beyond that event are not verified`;
+                }
+                else if (hit) {
+                    status.detail = `${event} configured; last observed ${hit.at} on Hunch ${hit.version}${hit.version === report.expectedVersion ? " (stale)" : `, not the expected ${report.expectedVersion}`}`;
+                }
+                else {
+                    status.detail = `${event} configured; host delivery, matchers, and tool coverage are not verified`;
+                }
             }
         }
     }
@@ -250,7 +280,7 @@ export function formatIntegrationHealth(report) {
         `Hunch integrations — expected ${report.expectedVersion} (repository configuration only)`,
         ...report.harnesses.map(h => `${h.harness}:\n${CAPABILITIES.map(c => `  ${c}: ${h.capabilities[c].status} — ${h.capabilities[c].detail}`).join("\n")}`),
         ...report.issues.map(i => `ERROR ${i.file}: ${i.detail}`),
-        "Configured hooks are untested until exercised inside the host. Global settings, active sessions, and model compliance are not verified.",
+        "Hooks become verified only from lifecycle events observed inside the host on the expected version within 30 days. Global settings, active sessions, and model compliance are not verified.",
     ].join("\n");
 }
 /** Bounded session warning; diagnostics must never break hook execution. */

package/dist/mcp/taskReportTools.d.ts

@@ -1,3 +1,188 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { readTaskReport } from "../core/taskReport.js";
 import type { HunchStore } from "../store/hunchStore.js";
+/** A tool result must fit the host's round-trip. The full report (every
+ * envelope's context text, every lesson) belongs to `hunch report --json` and
+ * the HTML view; MCP returns exact identities, verdicts and the card. Bounded
+ * by caps first, then by byte size (fnd_53991b877b: an 18-delivery task
+ * produced a 101 KB result the host refused). */
+export declare const MCP_REPORT_BYTE_BUDGET = 48000;
+export declare function boundedTaskReport(report: ReturnType<typeof readTaskReport>, deliveries?: number, recordsPerDelivery?: number): {
+    schema: "hunch.task-report-summary/1";
+    task: {
+        task_id: string;
+        scope: string;
+        title: string;
+        started_at: string;
+        finished_at: string | null;
+        state: "open" | "completed" | "interrupted";
+    };
+    coverage: "delivered" | "no-delivery-observed" | "no-relevant-memory";
+    content_hash: string;
+    unknowns: string[];
+    deliveries: {
+        occurrence_id: string;
+        receipt_id: string;
+        at: string;
+        envelope_hash: string;
+        delivered: number;
+        abstention: boolean;
+        records: {
+            record_id: string;
+            kind: string;
+            content_hash: string;
+            title: string;
+        }[];
+        more_records: number;
+    }[];
+    claims: {
+        action: string;
+        occurrence_id: string;
+        record_id: string;
+        content_hash: string;
+        at: string;
+        attribution: "agent-reported";
+        supported_by: string | null;
+    }[];
+    checks: {
+        check_id: string | undefined;
+        label: string;
+        command: string[];
+        exit_code: number | null;
+        timed_out: boolean;
+        cancelled: boolean;
+        current: boolean;
+        at: string;
+    }[];
+    conformance: {
+        record_id: string;
+        kind: "decisions" | "constraints";
+        content_hash: string;
+        rule: "constraint-forbids" | "decision-conformance";
+        outcome: "satisfied" | "violated" | "not-exercised" | "unavailable";
+        current: boolean;
+        files: string[];
+        detail: string;
+    }[];
+    saves: {
+        event_id: string;
+        at: string;
+        record_id: string;
+        kind: string;
+        content_hash: string;
+        title: string;
+        home: "public" | "private";
+        operation: "updated" | "created";
+        durability: "committed" | "pushed" | "local";
+    }[];
+    refusals: ({
+        source: "native-edit-gate";
+        outcome: "denial-emitted";
+        kind: "constraint" | "veto";
+        record_id: string;
+        target: string;
+        reason_hash: string;
+    } & {
+        event_id: string;
+        at: string;
+    })[];
+    omitted: {
+        deliveries: number;
+        claims: number;
+        checks: number;
+        conformance: number;
+        saves: number;
+        refusals: number;
+    };
+    full_report: string;
+};
+export declare function boundedTaskReportForHost(report: ReturnType<typeof readTaskReport>): {
+    schema: "hunch.task-report-summary/1";
+    task: {
+        task_id: string;
+        scope: string;
+        title: string;
+        started_at: string;
+        finished_at: string | null;
+        state: "open" | "completed" | "interrupted";
+    };
+    coverage: "delivered" | "no-delivery-observed" | "no-relevant-memory";
+    content_hash: string;
+    unknowns: string[];
+    deliveries: {
+        occurrence_id: string;
+        receipt_id: string;
+        at: string;
+        envelope_hash: string;
+        delivered: number;
+        abstention: boolean;
+        records: {
+            record_id: string;
+            kind: string;
+            content_hash: string;
+            title: string;
+        }[];
+        more_records: number;
+    }[];
+    claims: {
+        action: string;
+        occurrence_id: string;
+        record_id: string;
+        content_hash: string;
+        at: string;
+        attribution: "agent-reported";
+        supported_by: string | null;
+    }[];
+    checks: {
+        check_id: string | undefined;
+        label: string;
+        command: string[];
+        exit_code: number | null;
+        timed_out: boolean;
+        cancelled: boolean;
+        current: boolean;
+        at: string;
+    }[];
+    conformance: {
+        record_id: string;
+        kind: "decisions" | "constraints";
+        content_hash: string;
+        rule: "constraint-forbids" | "decision-conformance";
+        outcome: "satisfied" | "violated" | "not-exercised" | "unavailable";
+        current: boolean;
+        files: string[];
+        detail: string;
+    }[];
+    saves: {
+        event_id: string;
+        at: string;
+        record_id: string;
+        kind: string;
+        content_hash: string;
+        title: string;
+        home: "public" | "private";
+        operation: "updated" | "created";
+        durability: "committed" | "pushed" | "local";
+    }[];
+    refusals: ({
+        source: "native-edit-gate";
+        outcome: "denial-emitted";
+        kind: "constraint" | "veto";
+        record_id: string;
+        target: string;
+        reason_hash: string;
+    } & {
+        event_id: string;
+        at: string;
+    })[];
+    omitted: {
+        deliveries: number;
+        claims: number;
+        checks: number;
+        conformance: number;
+        saves: number;
+        refusals: number;
+    };
+    full_report: string;
+};
 export declare function registerTaskReportTools(server: McpServer, getRoot: () => string, getStore: () => HunchStore): void;

package/dist/mcp/taskReportTools.js

@@ -6,6 +6,47 @@ import { renderTaskReport, writeTaskReportHtml } from "../core/taskReportRender.
 function applicationReferences(report) {
     return report.deliveries.flatMap(d => d.records.map(r => ({ occurrence_id: d.occurrence_id, record_id: r.record_id, content_hash: r.content_hash, title: r.title }))).slice(-100);
 }
+/** A tool result must fit the host's round-trip. The full report (every
+ * envelope's context text, every lesson) belongs to `hunch report --json` and
+ * the HTML view; MCP returns exact identities, verdicts and the card. Bounded
+ * by caps first, then by byte size (fnd_53991b877b: an 18-delivery task
+ * produced a 101 KB result the host refused). */
+export const MCP_REPORT_BYTE_BUDGET = 48_000;
+export function boundedTaskReport(report, deliveries = 30, recordsPerDelivery = 25) {
+    const clip = (s, n) => (s.length > n ? `${s.slice(0, n - 1)}…` : s);
+    const tail = (items, n) => items.slice(Math.max(0, items.length - n));
+    return {
+        schema: "hunch.task-report-summary/1",
+        task: report.task, coverage: report.coverage, content_hash: report.content_hash, unknowns: report.unknowns,
+        deliveries: tail(report.deliveries, deliveries).map(d => ({
+            occurrence_id: d.occurrence_id, receipt_id: d.receipt_id, at: d.at, envelope_hash: d.envelope_hash,
+            delivered: d.envelope.delivered.length, abstention: d.envelope.abstention.active,
+            records: d.records.slice(0, recordsPerDelivery).map(r => ({ record_id: r.record_id, kind: r.kind, content_hash: r.content_hash, title: clip(r.title, 160) })),
+            more_records: Math.max(0, d.records.length - recordsPerDelivery),
+        })),
+        claims: tail(report.claims, 20).map(c => ({ ...c, action: clip(c.action, 300) })),
+        checks: tail(report.checks, 30).map(c => ({ check_id: c.check_id, label: c.label, command: c.command.map(x => clip(x, 120)), exit_code: c.exit_code, timed_out: c.timed_out, cancelled: c.cancelled ?? false, current: c.current, at: c.at })),
+        conformance: tail(report.conformance, 50).map(r => ({ record_id: r.record_id, kind: r.kind, content_hash: r.content_hash, rule: r.rule, outcome: r.outcome, current: r.current, files: r.files.slice(0, 8), detail: clip(r.detail, 240) })),
+        saves: tail(report.saves, 30).map(s => ({ event_id: s.event_id, at: s.at, record_id: s.record.record_id, kind: s.record.kind, content_hash: s.record.content_hash, title: clip(s.record.title, 160), home: s.home, operation: s.operation, durability: s.durability })),
+        refusals: tail(report.refusals, 30),
+        omitted: {
+            deliveries: Math.max(0, report.deliveries.length - deliveries), claims: Math.max(0, report.claims.length - 20), checks: Math.max(0, report.checks.length - 30),
+            conformance: Math.max(0, report.conformance.length - 50), saves: Math.max(0, report.saves.length - 30), refusals: Math.max(0, report.refusals.length - 30),
+        },
+        full_report: `hunch report ${report.task.task_id} --json`,
+    };
+}
+export function boundedTaskReportForHost(report) {
+    // Shrink deterministically until the summary fits; identities are never dropped
+    // from what remains, and `omitted` says exactly how much fell off.
+    for (const [deliveries, records] of [[30, 25], [10, 10], [5, 5], [1, 5], [1, 1]]) {
+        const summary = boundedTaskReport(report, deliveries, records);
+        if (JSON.stringify(summary).length <= MCP_REPORT_BYTE_BUDGET)
+            return summary;
+    }
+    const minimal = boundedTaskReport(report, 1, 1);
+    return { ...minimal, deliveries: [], omitted: { ...minimal.omitted, deliveries: report.deliveries.length } };
+}
 /** Reuse the MCP server's installation, not a potentially stale global binary.
  * Structured argv is authoritative; the shell hint uses literal quoting. */
 function verificationLauncher() {
@@ -34,7 +75,7 @@ export function registerTaskReportTools(server, getRoot, getStore) {
                     throw new Error("start requires a short task title and no completion evidence");
                 const task = startReportTask(root, title, task_id);
                 const launcher = verificationLauncher();
-                return { content: [{ type: "text", text: `Task ${task.task_id} · ${task.state}. Pass task_id to every hunch_context and decision/correction/finding capture call. Before the final response, finish with hunch_task and include its contribution card. For checks use this exact installation (the global hunch binary may be stale): ${launcher.shell} task verify ${task.task_id} -- <command> [arguments].` }], structuredContent: { task, verification_argv: [...launcher.argv, "task", "verify", task.task_id, "--"] } };
+                return { content: [{ type: "text", text: `Task ${task.task_id} · ${task.state}. Pass task_id to every hunch_context and decision/correction/finding capture call. Before the final response, finish with hunch_task and include its contribution card. For checks use this exact installation (the global hunch binary may be stale): ${launcher.shell} task verify ${task.task_id} -- <command> [arguments]. The default budget is 2 minutes; add --timeout <seconds> before -- for a long suite.` }], structuredContent: { task, verification_argv: [...launcher.argv, "task", "verify", task.task_id, "--"] } };
             }
             if (!task_id)
                 throw new Error("finish requires the exact task_id");
@@ -57,7 +98,7 @@ export function registerTaskReportTools(server, getRoot, getStore) {
             }
             catch { /* retained report remains inspectable through MCP */ }
             const card = file ? renderTaskReport(report).replace(/^Evidence .*$/m, `Evidence  [Open local report](<${file}>)`) : renderTaskReport(report);
-            return { content: [{ type: "text", text: show ? card : "Task report retained. Automatic presentation is disabled; omit the contribution card from the final response." }], structuredContent: { ...report, presentation_enabled: show, contribution_card: show ? card : null, report_path: file } };
+            return { content: [{ type: "text", text: show ? card : "Task report retained. Automatic presentation is disabled; omit the contribution card from the final response." }], structuredContent: { ...boundedTaskReportForHost(report), presentation_enabled: show, contribution_card: show ? card : null, report_path: file } };
         }
         catch (error) {
             const message = `Task report unavailable: ${error.message}`;
@@ -75,7 +116,7 @@ export function registerTaskReportTools(server, getRoot, getStore) {
     });
     server.registerTool("hunch_report", {
         title: "Inspect the evidence for Hunch's contribution to a task",
-        description: "Read task reports: exact delivered memory, agent-reported applications, observed command results and explicit unknowns. Supply lesson for exact revision history across tasks. With neither task_id nor lesson, lists recent tasks without guessing which is yours. html writes a local private evidence view. Not a causal impact score, public export, or authority to execute verification commands.",
+        description: "Read task reports: exact delivered memory, agent-reported applications, observed command results and explicit unknowns, as a bounded summary (identities and verdicts, not envelope text; the full report is `hunch report <id> --json`). Supply lesson for exact revision history across tasks. With neither task_id nor lesson, lists recent tasks without guessing which is yours. html writes a local private evidence view. Not a causal impact score, public export, or authority to execute verification commands.",
         inputSchema: { task_id: TaskIdSchema.optional(), lesson: LessonReferenceSchema.optional().describe("Exact kind and record_id, optionally content_hash, to inspect retained appearances across tasks. Partial indexing requires refreshing before pagination."), before: z.number().int().positive().optional(), html: z.boolean().optional(), cwd: z.string().optional() },
     }, async ({ task_id, lesson, before, html }) => {
         try {
@@ -96,7 +137,7 @@ export function registerTaskReportTools(server, getRoot, getStore) {
             }
             const report = readTaskReport(root, task_id, reportSourceSnapshot(root).hash);
             const file = html ? writeTaskReportHtml(root, task_id) : null;
-            return { content: [{ type: "text", text: `${renderTaskReport(report)}${file ? `\nLocal evidence view: ${file}` : ""}` }], structuredContent: { ...report, application_references: applicationReferences(report), contribution_card: renderTaskReport(report), report_path: file } };
+            return { content: [{ type: "text", text: `${renderTaskReport(report)}${file ? `\nLocal evidence view: ${file}` : ""}` }], structuredContent: { ...boundedTaskReportForHost(report), application_references: applicationReferences(report), contribution_card: renderTaskReport(report), report_path: file } };
         }
         catch (error) {
             return { isError: true, content: [{ type: "text", text: `Invalid: ${error.message}` }] };

package/dist/taskReports.d.ts

@@ -1,5 +1,6 @@
 import { type ReportClaim, type ReportRecord, type LessonReference } from "./core/taskReport.js";
 import { runReportCheck } from "./core/taskReportEvidence.js";
+export { DEFAULT_CHECK_TIMEOUT_MS, MAX_CHECK_TIMEOUT_MS } from "./core/taskReportEvidence.js";
 import type { DeliveryEnvelope } from "./core/delivery.js";
 export type { TaskReport, ReportTask, ReportClaim, ReportCheck, ReportConformance, ReportSave, ReportDurability, ReportRefusal, ReportRecord, TaskDelivery, LessonReference, LessonHistory } from "./core/taskReport.js";
 export { TASK_REPORT_SCHEMA, TaskIdSchema } from "./core/taskReport.js";
@@ -28,7 +29,9 @@ export declare function createTaskReporter(root: string): {
     applied(taskId: string, claim: ReportClaim): string;
     /** Runs locally as argv, without a shell. Only use commands authorized by
      * the task owner. This API does not accept remote claimed-success receipts. */
-    verify(taskId: string, command: string[], label: string, options?: Parameters<typeof runReportCheck>[5]): Promise<{
+    verify(taskId: string, command: string[], label: string, options?: Parameters<typeof runReportCheck>[5] & {
+        timeoutMs?: number;
+    }): Promise<{
         label: string;
         command: string[];
         exit_code: number | null;

package/dist/taskReports.js

@@ -3,7 +3,8 @@
 import { realpathSync } from "node:fs";
 import { z } from "zod";
 import { finishReportTask, listReportTasks, readTaskReport, readLessonHistory, recordReportClaim, recordTaskDelivery, reportHash, reportPresentationEnabled, startReportTask } from "./core/taskReport.js";
-import { reportSourceSnapshot, runReportCheck, runReportConformance } from "./core/taskReportEvidence.js";
+import { DEFAULT_CHECK_TIMEOUT_MS, reportSourceSnapshot, runReportCheck, runReportConformance } from "./core/taskReportEvidence.js";
+export { DEFAULT_CHECK_TIMEOUT_MS, MAX_CHECK_TIMEOUT_MS } from "./core/taskReportEvidence.js";
 import { renderTaskReport, writeTaskReportHtml } from "./core/taskReportRender.js";
 import { hunchPaths } from "./core/paths.js";
 import { HunchStore } from "./store/hunchStore.js";
@@ -34,7 +35,8 @@ export function createTaskReporter(root) {
         /** Runs locally as argv, without a shell. Only use commands authorized by
          * the task owner. This API does not accept remote claimed-success receipts. */
         verify(taskId, command, label, options) {
-            return runReportCheck(scope, taskId, command, label, 120_000, options);
+            const { timeoutMs = DEFAULT_CHECK_TIMEOUT_MS, ...rest } = options ?? {};
+            return runReportCheck(scope, taskId, command, label, timeoutMs, rest);
         },
         /** Hunch evaluates each delivered lesson's declared rule against the changed
          * files. Deterministic and local; the harness supplies no verdict. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.32.0",
+  "version": "1.32.1",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.32.0",
+  "version": "1.32.1",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.32.0",
+      "version": "1.32.1",
       "runtimeHint": "npx",
       "packageArguments": [
         {