@davesheffer/hunch 1.32.0 → 1.32.2

package/README.md

@@ -59,7 +59,7 @@ hunch integrations check --harness claude --probe --require mcp
 hunch integrations check --harness codex --require context,edit-blocking
 ```
 
-Capabilities are reported as **verified**, **advisory-only**, **unsupported** or **untested**. `--require` fails unless every named capability is verified.
+Capabilities are reported as **verified**, **advisory-only**, **unsupported** or **untested**. `--require` fails unless every named capability is verified. `mcp` is verified by a fresh-server probe; hook capabilities become verified only from lifecycle events actually delivered to Hunch's hook on the expected version within the last 30 days (machine-local evidence, the same trust level as the served ledger), so a repository whose agent has actually run shows it, and one that only has configuration does not.
 
 The Codex integration currently supplies MCP and instructions, with no native lifecycle adapter. The opt-in `--probe` verifies a fresh MCP process, not whether an existing host session or model actually followed the memory.
 

package/dist/cli/index.js

@@ -80,16 +80,18 @@ import { appendEvent, readEvents } from "../core/events.js";
 import { computeStats, formatStats } from "../core/stats.js";
 import { injectionMode, resetSessionInjections } from "../core/hookcache.js";
 import { recordServed, servedSummary } from "../core/served.js";
-import { recordTaskDelivery, reportActivity } from "../core/taskReport.js";
+import { recordTaskDelivery, reportActivity, reportPresentationEnabled, unseenLessons } from "../core/taskReport.js";
 import { snapshotDeliveredRecords } from "../core/taskReportEvidence.js";
+import { renderRecalledLine } from "../core/taskReportRender.js";
 import { hookReportTaskId, startHookReport, stopHookReport, observeHookDenial } from "../core/taskReportHook.js";
+import { recordHookObservation } from "../core/hookObservations.js";
 import { contextHookOutput, denyHookOutput, hookProvider, normalizeHookEvent, stopHookOutput } from "../core/agenthook.js";
 import { PIPELINE_LOOP, armExecutionObligations, beforeEditProbeVerdict, compileExecutableProbes, environmentExecutableProbes, environmentExecutionObligations, executionObligationBrief, isProductPath, loadPipelineState, onCommand, onEdit, onPrompt, onSkill, pipelineEnabled, proofCheckpoint, savePipelineState, stopVerdict, unverifiedNag, } from "../core/pipeline.js";
 import { draftDuplicateOf, isAcceptedDuplicateAnchor } from "../core/dupdetect.js";
 import { planAutoReview, planMutations } from "../core/autoreview.js";
 import { loadGoldenSet, evaluateRetrieval, evaluateTraversalLift } from "../eval/harness.js";
 import { loadGuardCases, evalGuards, generateGuardCases } from "../eval/guards.js";
-import { computeDrift } from "../core/drift.js";
+import { DRIFT_KINDS, computeDrift } from "../core/drift.js";
 import { renderCompilerScorecard, scoreCompilerCaseBank } from "../constitution/scorecard.js";
 import { generateWiki, wikiStatus, wikiPrompt, publicHome, privateHome, readWikiManifestAt, nowData } from "../wiki/wiki.js";
 import { adoptProsePrompt } from "../wiki/adopt.js";
@@ -107,6 +109,7 @@ import { MAX_LANDSCAPE_REFRESH_REVISIONS, planLandscapeAdoption, } from "../core
 import { discoverRepositoryLandscape } from "../extractors/landscapeDiscovery.js";
 import { checkConformance } from "../core/conformance.js";
 import { ConstitutionService, policyEvaluationEnvelope } from "../constitution/service.js";
+import { renderPolicyEvaluations } from "../constitution/renderEvaluations.js";
 import { sourceGraphSnapshot } from "../constitution/evaluator.js";
 import { renderProofCard } from "../constitution/card.js";
 import { movePolicyArtifactsToPrivate } from "../constitution/repository.js";
@@ -2294,20 +2297,6 @@ policyCmd
         store.close();
     }
 });
-function renderPolicyEvaluations(results) {
-    if (!results.length)
-        return ["No Constitution policies matched."];
-    const icon = { satisfied: "✅", violated: "⛔", not_applicable: "·", unknown: "?", error: "‼" };
-    const out = [`Constitution policy evaluation: ${results.length} canonical receipt(s)`];
-    for (const r of results) {
-        out.push(`  ${icon[r.evaluation.result] ?? "·"} ${r.policy.id} [${r.policy.state}] ${r.evaluation.result}${r.blocks ? " — BLOCK" : ""}`);
-        out.push(`     ${r.evaluation.explanation}`);
-        if (r.gate_error)
-            out.push(`     gate error: ${r.gate_error}`);
-        out.push(`     receipt: ${r.evaluation.deterministic_hash}`);
-    }
-    return out;
-}
 // ---- constitution (deterministic evidence -> candidate bootstrap) --------
 const constitutionCmd = program
     .command("constitution")
@@ -4200,8 +4189,9 @@ program
     if (opts.task) {
         try {
             const records = asOf ? [] : snapshotDeliveredRecords(store, envelope);
+            const recalled = renderRecalledLine(unseenLessons(root, opts.task, records));
             const occurrence = recordTaskDelivery(root, opts.task, envelope, records);
-            console.log(`\nTask evidence: ${opts.task} · occurrence ${occurrence}`);
+            console.log(`\n${recalled ? `${recalled}\n` : ""}Task evidence: ${opts.task} · occurrence ${occurrence}`);
         }
         catch {
             console.error(`Task evidence could not be recorded for ${opts.task}; context remains available but report attribution is unverified.`);
@@ -4471,6 +4461,9 @@ program
         if (!evt)
             return;
         const root = findRoot();
+        // The host delivered this event: runtime evidence for `hunch integrations check`,
+        // recorded before any policy decision so firmness never hides delivery itself.
+        recordHookObservation(root, provider, evt.hook_event_name);
         const paths = hunchPaths(root);
         const firmness = readConfig(paths).firmness;
         if (firmness === "off")
@@ -4890,16 +4883,22 @@ program
         }
         receipts("served");
         let reportNotice = "";
+        let recalled = null;
         if (reportTaskId) {
             try {
-                const occurrence = recordTaskDelivery(root, reportTaskId, envelope, snapshotDeliveredRecords(store, envelope));
+                const snapshots = snapshotDeliveredRecords(store, envelope);
+                // The first time a lesson reaches this prompt's task, tell the USER in one
+                // line (systemMessage); repeats of the same revision stay silent.
+                recalled = reportPresentationEnabled(root) ? renderRecalledLine(unseenLessons(root, reportTaskId, snapshots)) : null;
+                const occurrence = recordTaskDelivery(root, reportTaskId, envelope, snapshots);
                 reportNotice = `\n\nHunch task ${reportTaskId} · delivery ${occurrence}. Inspect exact application references with hunch_report(task_id).`;
             }
             catch {
                 reportNotice = "\n\nTask report observation unavailable; this delivery's task contribution remains unverified.";
+                recalled = null;
             }
         }
-        emitContext(provider, "PreToolUse", text + reportNotice);
+        emitContext(provider, "PreToolUse", text + reportNotice, recalled ?? undefined);
     }
     catch {
         // swallow — never block an edit on a hook failure
@@ -6027,8 +6026,13 @@ program
 // ---- drift (doc≠graph detector; advisory + CI-gateable) -------------------
 program
     .command("drift")
-    .description("Detect memory drift: dead refs, dangling supersedes, stale 'proposed' docs, commit-unresolvable (a decision cites a commit that no longer resolves in this repository), doc≠graph anchor-stale (a file still anchored to a superseded decision), markdown sections whose <!-- hunch:topic … dec_id --> pin points at a superseded or missing decision (AGENTS.md/CLAUDE.md as a drift surface), and ledger≠records replay divergence when this partition has a change ledger. Exits non-zero on any anchor-stale drift, topic collision or replay divergence — the doc≠graph and ledger≠records gate.")
-    .action(() => {
+    .description("Detect memory drift: dead refs, dangling supersedes, stale 'proposed' docs, commit-unresolvable (a decision cites a commit that no longer resolves in this repository), doc≠graph anchor-stale (a file still anchored to a superseded decision), markdown sections whose <!-- hunch:topic … dec_id --> pin points at a superseded or missing decision (AGENTS.md/CLAUDE.md as a drift surface), and ledger≠records replay divergence when this partition has a change ledger. Exits non-zero on any anchor-stale drift, topic collision or replay divergence — the doc≠graph and ledger≠records gate. --fail-on adds further kinds to the gate (the release gate passes finding-stale).")
+    .option("--fail-on <kinds>", `comma-separated drift kinds that also fail the gate (${DRIFT_KINDS.join(", ")})`)
+    .action((opts) => {
+    const failOn = new Set((opts.failOn ?? "").split(",").map((k) => k.trim()).filter(Boolean));
+    for (const kind of failOn)
+        if (!DRIFT_KINDS.includes(kind))
+            return fail(`--fail-on: unknown drift kind "${kind}" (known: ${DRIFT_KINDS.join(", ")})`);
     const { store, root } = storeFor();
     try {
         const { findings } = computeDrift(store, root);
@@ -6052,8 +6056,9 @@ program
         if (replayCount && !replayFailing.length)
             console.log(`· [replay-fingerprint] ${scopePath(own)}: ledger fold ${replay.replay_hash} ≠ stored ${replay.stored_hash}`);
         const anchor = findings.filter((f) => f.kind === "anchor-stale" || f.kind === "doc-anchor-stale").length;
-        console.log(`\n${findings.length + replayCount} finding(s)${anchor ? `, ${anchor} doc≠graph (anchor-stale)` : ""}${collisions.size ? `, ${collisions.size} topic-collision(s)` : ""}${replayCount ? `, ${replayCount} ledger≠records (replay: hunch serve replay --root .)` : ""}.`);
-        if (anchor || collisions.size || replayCount)
+        const failing = findings.filter((f) => failOn.has(f.kind)).length;
+        console.log(`\n${findings.length + replayCount} finding(s)${anchor ? `, ${anchor} doc≠graph (anchor-stale)` : ""}${collisions.size ? `, ${collisions.size} topic-collision(s)` : ""}${replayCount ? `, ${replayCount} ledger≠records (replay: hunch serve replay --root .)` : ""}${failing ? `, ${failing} failing by --fail-on (${[...failOn].join(", ")})` : ""}.`);
+        if (anchor || collisions.size || replayCount || failing)
             process.exitCode = 1;
     }
     finally {
@@ -6809,7 +6814,10 @@ function realpathNorm(p) {
 function toRepoRel(root, abs) {
     return relative(realpathNorm(root), realpathNorm(abs)).split("\\").join("/");
 }
-function emitContext(provider, event, text) {
+function emitContext(provider, event, text, 
+/** One user-facing line where the host shows hook messages (Claude Code's
+ * `systemMessage`); never a block, never a second model turn. */
+systemMessage) {
     if (event === "SessionStart") {
         const warning = integrationSessionWarning(findRoot(), provider);
         if (warning)
@@ -6817,7 +6825,7 @@ function emitContext(provider, event, text) {
     }
     const output = contextHookOutput(provider, event, text);
     if (output)
-        process.stdout.write(JSON.stringify(output));
+        process.stdout.write(JSON.stringify(provider === "claude" && systemMessage ? { ...output, systemMessage } : output));
 }
 function emitDeny(provider, reason) {
     const result = denyHookOutput(provider, reason);

package/dist/cli/taskReport.js

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { findRoot } from "../core/paths.js";
 import { writeFileAtomic } from "../core/io.js";
 import { finishReportTask, forgetReportTask, listReportTasks, pruneReportHistory, readTaskReport, readLessonHistory, startReportTask } from "../core/taskReport.js";
-import { reportSourceSnapshot, runReportCheck, runReportConformance } from "../core/taskReportEvidence.js";
+import { DEFAULT_CHECK_TIMEOUT_MS, MAX_CHECK_TIMEOUT_MS, reportSourceSnapshot, runReportCheck, runReportConformance } from "../core/taskReportEvidence.js";
 import { renderTaskReport, writeTaskReportHtml } from "../core/taskReportRender.js";
 import { assertReportPath } from "../core/taskReportPaths.js";
 import { publicTaskReport } from "../core/taskReportPublic.js";
@@ -59,8 +59,12 @@ export function registerTaskReportCommands(program, openStore) {
     });
     task.command("verify <id> <command...>").description("Explicitly run a verification command and retain its result/hash, never raw output; use -- before the command")
         .option("--label <label>", "short name of the check", "Verification command")
+        .option("--timeout <seconds>", `seconds before the command tree is stopped and recorded as timed out (max ${MAX_CHECK_TIMEOUT_MS / 1000})`, String(DEFAULT_CHECK_TIMEOUT_MS / 1000))
         .option("--json", "emit only the result JSON, suppressing live command output")
         .action(async (id, command, opts) => {
+        const seconds = Number(opts.timeout);
+        if (!Number.isInteger(seconds) || seconds < 1 || seconds * 1000 > MAX_CHECK_TIMEOUT_MS)
+            throw new Error(`--timeout must be a whole number of seconds between 1 and ${MAX_CHECK_TIMEOUT_MS / 1000}`);
         const controller = new AbortController();
         let signalExit = 0;
         const interrupt = () => { signalExit = 130; controller.abort(); };
@@ -68,7 +72,7 @@ export function registerTaskReportCommands(program, openStore) {
         process.on("SIGINT", interrupt);
         process.on("SIGTERM", terminate);
         try {
-            const result = await runReportCheck(findRoot(), id, command, opts.label, 120_000, {
+            const result = await runReportCheck(findRoot(), id, command, opts.label, seconds * 1000, {
                 signal: controller.signal,
                 onStdout: opts.json ? undefined : chunk => { process.stdout.write(chunk); },
                 onStderr: opts.json ? undefined : chunk => { process.stderr.write(chunk); },

package/dist/constitution/behaviorEvaluator.js

@@ -1,7 +1,7 @@
 import { execFileSync, spawnSync } from "node:child_process";
 import { dirname, join } from "node:path";
 import { pathToFileURL } from "node:url";
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { headSha } from "../extractors/git.js";
 import { canonicalHash } from "./canonical.js";
@@ -125,7 +125,14 @@ export function evaluateExecutableBehaviorPolicy(root, policy, opts = {}) {
     }
     const dependency = dependencySnapshotForCommit(root, commit, assertion.dependency_snapshot_ids);
     if (!dependency) {
-        return evaluation(policy, commit, { ...baseExecution, commit, error_code: "dependency-snapshot-unavailable" }, "error", "no unique exact dependency snapshot is available for executable behavior evaluation");
+        // Two different situations hid behind one message (fnd_b421b3f7ab): a machine
+        // that never built the snapshot cache, and a policy whose pinned snapshots no
+        // longer match the commit's dependency inputs. Name each with its recovery;
+        // both stay `error`, never a coerced pass.
+        if (!existsSync(join(root, ".hunch-cache", "behavior-deps"))) {
+            return evaluation(policy, commit, { ...baseExecution, commit, error_code: "dependency-snapshot-cache-absent" }, "error", "no dependency snapshot cache exists on this machine (.hunch-cache/behavior-deps); executable behavior is unevaluated here, not failed — provision the policy's snapshots (hunch constitution bootstrap --behavior-deps <candidate>) or evaluate where they were built");
+        }
+        return evaluation(policy, commit, { ...baseExecution, commit, error_code: "dependency-snapshot-unavailable" }, "error", `no unique exact dependency snapshot matches this commit's package.json/package-lock.json among the policy's pinned ids (${assertion.dependency_snapshot_ids.join(", ")}); dependency inputs changed since compilation — re-plan and re-prove the policy (rb_g2_stale_policy_01)`);
     }
     const session = mkdtempSync(join(tmpdir(), "hunch-behavior-policy-"));
     const hooks = join(session, "hooks-disabled");

package/dist/constitution/renderEvaluations.d.ts

@@ -0,0 +1,8 @@
+/** Terminal rendering of canonical policy receipts, shared by `hunch policy
+ * evaluate` and the pre-commit `hunch check`. Rendering never alters a receipt.
+ * Receipts that did not evaluate (error / unknown / not_applicable) and share
+ * one explanation are grouped, so ten policies failing for the same
+ * environmental reason read as one actionable block instead of ten
+ * (fnd_b421b3f7ab); satisfied and violated policies always stay one per line. */
+import type { PolicyEvaluationSet } from "./service.js";
+export declare function renderPolicyEvaluations(results: PolicyEvaluationSet[]): string[];

package/dist/constitution/renderEvaluations.js

@@ -0,0 +1,48 @@
+const ICON = { satisfied: "✅", violated: "⛔", not_applicable: "·", unknown: "?", error: "‼" };
+const GROUP_AT = 3;
+function groupKey(r) {
+    const result = r.evaluation.result;
+    const groupable = (result === "error" || result === "unknown" || result === "not_applicable") && !r.blocks && !r.gate_error;
+    if (!groupable)
+        return `one ${r.policy.id}`;
+    return `${r.policy.state} ${result} ${r.evaluation.explanation}`;
+}
+export function renderPolicyEvaluations(results) {
+    if (!results.length)
+        return ["No Constitution policies matched."];
+    const out = [`Constitution policy evaluation: ${results.length} canonical receipt(s)`];
+    const groups = new Map();
+    for (const r of results) {
+        const key = groupKey(r);
+        const members = groups.get(key) ?? [];
+        members.push(r);
+        groups.set(key, members);
+    }
+    const rendered = new Set();
+    for (const r of results) {
+        if (rendered.has(r))
+            continue;
+        const members = groups.get(groupKey(r)) ?? [r];
+        const icon = ICON[r.evaluation.result] ?? "·";
+        if (members.length >= GROUP_AT) {
+            for (const member of members)
+                rendered.add(member);
+            const ids = members.map((m) => m.policy.id);
+            const receipts = members.map((m) => `${m.policy.id}=${m.evaluation.deterministic_hash.slice(0, 17)}`);
+            out.push(`  ${icon} ${members.length} policies [${r.policy.state}] ${r.evaluation.result} — same cause`);
+            out.push(`     ${r.evaluation.explanation}`);
+            out.push(`     policies: ${ids.join(", ")}`);
+            out.push(`     receipts: ${receipts.join(" ")}`);
+            out.push("     full receipts: hunch policy evaluate --json");
+            continue;
+        }
+        rendered.add(r);
+        out.push(`  ${icon} ${r.policy.id} [${r.policy.state}] ${r.evaluation.result}${r.blocks ? " — BLOCK" : ""}`);
+        out.push(`     ${r.evaluation.explanation}`);
+        if (r.gate_error)
+            out.push(`     gate error: ${r.gate_error}`);
+        out.push(`     receipt: ${r.evaluation.deterministic_hash}`);
+    }
+    return out;
+}
+//# sourceMappingURL=renderEvaluations.js.map

package/dist/core/drift.d.ts

@@ -1,5 +1,6 @@
 import type { HunchStore } from "../store/hunchStore.js";
-export type DriftKind = "dead-ref" | "supersede" | "doc-stale" | "anchor-stale" | "doc-anchor-stale" | "doc-anchor-dangling" | "wiki-stale" | "finding-stale" | "premise-stale" | "commit-unresolvable" | "madr-stale" | "madr-edited" | "madr-orphan";
+export declare const DRIFT_KINDS: readonly ["dead-ref", "supersede", "doc-stale", "anchor-stale", "doc-anchor-stale", "doc-anchor-dangling", "wiki-stale", "finding-stale", "premise-stale", "commit-unresolvable", "madr-stale", "madr-edited", "madr-orphan"];
+export type DriftKind = typeof DRIFT_KINDS[number];
 export interface DriftFinding {
     kind: DriftKind;
     id: string;

package/dist/core/drift.js

@@ -27,6 +27,7 @@ import { markdownDocs, STALE_MARKER, SRC_REF } from "./docscan.js";
 import { computeWikiDrift } from "../wiki/wiki.js";
 import { computeMadrDrift } from "../integrations/madrManifest.js";
 import { commitsExist, isGitRepo } from "../extractors/git.js";
+export const DRIFT_KINDS = ["dead-ref", "supersede", "doc-stale", "anchor-stale", "doc-anchor-stale", "doc-anchor-dangling", "wiki-stale", "finding-stale", "premise-stale", "commit-unresolvable", "madr-stale", "madr-edited", "madr-orphan"];
 export function computeDrift(store, root, deps = {}) {
     const findings = [];
     const decisions = store.recs("decisions");

package/dist/core/hookObservations.d.ts

@@ -0,0 +1,9 @@
+export interface HookObservation {
+    provider: string;
+    event: string;
+    at: string;
+    version: string;
+}
+/** Never throws (con_03a0b94b2e): a missing ledger costs evidence, not the edit. */
+export declare function recordHookObservation(root: string, provider: string, event: string): void;
+export declare function readHookObservations(root: string): HookObservation[];

package/dist/core/hookObservations.js

@@ -0,0 +1,33 @@
+/** Runtime evidence that a host actually delivered a lifecycle event to Hunch's
+ * hook. Configuration proves wiring; only an observed event proves delivery.
+ * One row per (provider, normalized event), machine-local, outside the
+ * rebuildable index. Recording is best-effort: a hook must never fail on it. */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { withServedDatabase } from "./served.js";
+import { HUNCH_VERSION } from "./version.js";
+function ensureTable(db) {
+    db.exec(`CREATE TABLE IF NOT EXISTS hook_observations (
+    provider TEXT NOT NULL, event TEXT NOT NULL, at TEXT NOT NULL, version TEXT NOT NULL,
+    PRIMARY KEY (provider, event)
+  )`);
+}
+/** Never throws (con_03a0b94b2e): a missing ledger costs evidence, not the edit. */
+export function recordHookObservation(root, provider, event) {
+    try {
+        withServedDatabase(root, db => {
+            ensureTable(db);
+            db.prepare("INSERT OR REPLACE INTO hook_observations VALUES (?, ?, ?, ?)").run(provider, event, new Date().toISOString(), HUNCH_VERSION);
+        });
+    }
+    catch { /* evidence is optional; the hook response is not */ }
+}
+export function readHookObservations(root) {
+    if (!existsSync(join(root, ".hunch-cache", "served.db")))
+        return [];
+    return withServedDatabase(root, db => {
+        ensureTable(db);
+        return db.prepare("SELECT provider, event, at, version FROM hook_observations ORDER BY at DESC").all();
+    });
+}
+//# sourceMappingURL=hookObservations.js.map

package/dist/core/taskReport.d.ts

@@ -198,6 +198,12 @@ export declare function readLessonHistory(root: string, reference: LessonReferen
     before?: number;
 }): LessonHistory;
 export declare function startReportTask(root: string, title: string, taskId?: string): ReportTask;
+/** The record revisions among `records` that this task has not received before.
+ * Powers the one-line "Hunch recalled …" indication on a lesson's FIRST delivery
+ * in a task; repeats of the same revision stay silent (deduplicated per task and
+ * revision, never per session or file). Read-only; never throws for callers
+ * that must stay silent on failure — they catch. */
+export declare function unseenLessons(root: string, taskId: string, records: readonly ReportRecord[]): ReportRecord[];
 /** Strict operation for explicit callers. Passive integrations catch failure
  * and disclose it without blocking context delivery. Empty envelopes count. */
 export declare function recordTaskDelivery(root: string, taskId: string, envelope: DeliveryEnvelope, records: ReportRecord[], occurrenceId?: string): string;

package/dist/core/taskReport.js

@@ -281,6 +281,21 @@ function appendEvent(root, taskId, kind, body, eventId) {
         return id;
     }));
 }
+/** The record revisions among `records` that this task has not received before.
+ * Powers the one-line "Hunch recalled …" indication on a lesson's FIRST delivery
+ * in a task; repeats of the same revision stay silent (deduplicated per task and
+ * revision, never per session or file). Read-only; never throws for callers
+ * that must stay silent on failure — they catch. */
+export function unseenLessons(root, taskId, records) {
+    if (!records.length)
+        return [];
+    return taskDb(root, db => {
+        readTask(db, root, taskId);
+        const seen = db.prepare(`SELECT 1 FROM report_record_links l JOIN report_events e ON e.event_id = l.event_id
+      WHERE e.task_id = ? AND e.kind = 'delivery' AND l.kind = ? AND l.record_id = ? AND l.content_hash = ? LIMIT 1`);
+        return records.filter(r => !seen.get(taskId, r.kind, r.record_id, r.content_hash));
+    });
+}
 /** Strict operation for explicit callers. Passive integrations catch failure
  * and disclose it without blocking context delivery. Empty envelopes count. */
 export function recordTaskDelivery(root, taskId, envelope, records, occurrenceId = `hocc_${randomBytes(12).toString("hex")}`) {

package/dist/core/taskReportEvidence.d.ts

@@ -17,6 +17,8 @@ export declare function reportSourceSnapshot(root: string): ReportSnapshot;
  * predicate's subject lives in a changed file. Everything else stays
  * `not-exercised` or `unavailable` — never "satisfied" by file overlap. */
 export declare function runReportConformance(root: string, store: HunchStore, taskId: string): ReportConformance[];
+export declare const DEFAULT_CHECK_TIMEOUT_MS = 120000;
+export declare const MAX_CHECK_TIMEOUT_MS: number;
 /** A deliberately explicit command wrapper. The caller chooses the command;
  * reports never execute commands automatically to validate submitted claims. */
 export declare function runReportCheck(root: string, taskId: string, command: string[], label: string, timeoutMs?: number, options?: {

package/dist/core/taskReportEvidence.js

@@ -190,11 +190,15 @@ export function runReportConformance(root, store, taskId) {
         return value;
     });
 }
+export const DEFAULT_CHECK_TIMEOUT_MS = 120_000;
+export const MAX_CHECK_TIMEOUT_MS = 6 * 60 * 60_000;
 /** A deliberately explicit command wrapper. The caller chooses the command;
  * reports never execute commands automatically to validate submitted claims. */
 export async function runReportCheck(root, taskId, command, label, timeoutMs = 120_000, options = {}) {
-    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 600_000)
-        throw new Error("verification timeout must be between 1 and 600000 ms");
+    // A full suite can legitimately run for half an hour (fnd_70dd5c4034); the
+    // bound exists so an abandoned runner cannot hold a task open indefinitely.
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_CHECK_TIMEOUT_MS)
+        throw new Error(`verification timeout must be between 1 and ${MAX_CHECK_TIMEOUT_MS} ms`);
     options.signal?.throwIfAborted();
     const task = readTaskReport(root, taskId).task;
     if (task.state !== "open")

package/dist/core/taskReportRender.d.ts

@@ -1,5 +1,10 @@
 import { type LessonHistory, type TaskReport } from "./taskReport.js";
 export declare function writeTaskReportHtml(root: string, taskId: string, publicOnly?: boolean): string;
+/** One short line for the first time a lesson reaches a task; null when every
+ * delivered revision was already seen in this task. Never a banner per delivery. */
+export declare function renderRecalledLine(fresh: readonly {
+    title: string;
+}[]): string | null;
 export declare function renderTaskReport(report: TaskReport): string;
 /** Standalone, local-only projection. No active content, external assets or
  * untrusted outbound URLs; evidence references are internal anchors. */

package/dist/core/taskReportRender.js

@@ -36,6 +36,14 @@ function ruleStanding(report) {
 function recordTitle(report, rule) {
     return uniqueRecords(report).find(r => r.kind === rule.kind && r.record_id === rule.record_id && r.content_hash === rule.content_hash)?.title ?? rule.record_id;
 }
+/** One short line for the first time a lesson reaches a task; null when every
+ * delivered revision was already seen in this task. Never a banner per delivery. */
+export function renderRecalledLine(fresh) {
+    if (!fresh.length)
+        return null;
+    const rest = fresh.length - 1;
+    return `Hunch recalled: ${clip(fresh[0].title, 90)}${rest ? ` (+${rest} more lesson${rest === 1 ? "" : "s"})` : ""}`;
+}
 export function renderTaskReport(report) {
     const records = uniqueRecords(report);
     const lines = [`Hunch · ${clip(report.task.title)}`, `Task ${report.task.task_id} · ${report.task.state}`];

package/dist/integrations/health.js

@@ -8,6 +8,15 @@ import { writeFileAtomic } from "../core/io.js";
 import { HUNCH_VERSION } from "../core/version.js";
 import { readConfig } from "../core/config.js";
 import { hunchPaths } from "../core/paths.js";
+import { readHookObservations } from "../core/hookObservations.js";
+/** Normalized hook events that prove each capability was delivered by the host. */
+const CAPABILITY_EVIDENCE = {
+    context: ["SessionStart", "UserPromptSubmit"],
+    "edit-blocking": ["PreToolUse"],
+    "failure-capture": ["PostToolUseFailure", "PostToolUse"],
+    compaction: ["PreCompact"],
+};
+const OBSERVATION_FRESH_MS = 30 * 86_400_000;
 export const CAPABILITIES = ["mcp", "context", "edit-blocking", "failure-capture", "compaction"];
 export const HARNESSES = {
     claude: { mcp: ".mcp.json", hooks: ".claude/settings.json", key: "mcpServers", events: ["SessionStart", "PreToolUse", "PostToolUseFailure", "PreCompact"] },
@@ -112,6 +121,14 @@ export function inspectIntegrations(root, selected) {
             }
         }
     };
+    // Machine-local runtime evidence; an unreadable ledger simply leaves hooks untested.
+    let observed = [];
+    try {
+        observed = readHookObservations(root);
+    }
+    catch {
+        observed = [];
+    }
     for (const harness of selected ? [selected] : Object.keys(HARNESSES)) {
         const spec = HARNESSES[harness];
         if (!selected && !existsSync(join(root, spec.mcp)) && (!spec.hooks || !existsSync(join(root, spec.hooks))))
@@ -163,7 +180,20 @@ export function inspectIntegrations(root, selected) {
                 status.detail = `firmness=${firmness}; edits are not blocked`;
             }
             else {
-                status.detail = `${event} configured; host delivery, matchers, and tool coverage are not verified`;
+                // Verified only by an event the host actually delivered, on the expected
+                // version, recently. Matchers and tool coverage beyond that event stay unproven.
+                const hit = observed.find(o => o.provider === harness && CAPABILITY_EVIDENCE[capability].includes(o.event));
+                const fresh = hit !== undefined && Date.now() - Date.parse(hit.at) <= OBSERVATION_FRESH_MS;
+                if (hit && fresh && hit.version === report.expectedVersion) {
+                    status.status = "verified";
+                    status.detail = `${hit.event} observed from the ${harness} host at ${hit.at} on Hunch ${hit.version}; matchers and tool coverage beyond that event are not verified`;
+                }
+                else if (hit) {
+                    status.detail = `${event} configured; last observed ${hit.at} on Hunch ${hit.version}${hit.version === report.expectedVersion ? " (stale)" : `, not the expected ${report.expectedVersion}`}`;
+                }
+                else {
+                    status.detail = `${event} configured; host delivery, matchers, and tool coverage are not verified`;
+                }
             }
         }
     }
@@ -250,7 +280,7 @@ export function formatIntegrationHealth(report) {
         `Hunch integrations — expected ${report.expectedVersion} (repository configuration only)`,
         ...report.harnesses.map(h => `${h.harness}:\n${CAPABILITIES.map(c => `  ${c}: ${h.capabilities[c].status} — ${h.capabilities[c].detail}`).join("\n")}`),
         ...report.issues.map(i => `ERROR ${i.file}: ${i.detail}`),
-        "Configured hooks are untested until exercised inside the host. Global settings, active sessions, and model compliance are not verified.",
+        "Hooks become verified only from lifecycle events observed inside the host on the expected version within 30 days. Global settings, active sessions, and model compliance are not verified.",
     ].join("\n");
 }
 /** Bounded session warning; diagnostics must never break hook execution. */

package/dist/mcp/server.js

@@ -40,7 +40,8 @@ import { PROJECT_DNA_DELTA_SCHEMA_VERSION, diffProjectDna } from "../core/projec
 import { projectDnaDeliverySupplement } from "../core/projectDnaDelivery.js";
 import { armExecutionObligations, loadPipelineState, savePipelineState } from "../core/pipeline.js";
 import { recordServed } from "../core/served.js";
-import { TaskIdSchema, recordTaskDelivery } from "../core/taskReport.js";
+import { TaskIdSchema, recordTaskDelivery, unseenLessons } from "../core/taskReport.js";
+import { renderRecalledLine } from "../core/taskReportRender.js";
 import { observeReportCapture } from "../core/taskReportCapture.js";
 import { snapshotDeliveredRecords } from "../core/taskReportEvidence.js";
 import { registerTaskReportTools } from "./taskReportTools.js";
@@ -1049,8 +1050,10 @@ export function buildServerWithRootControl(initialRoot, options = {}) {
                 try {
                     // Historical contexts must not borrow today's record text/revision.
                     const records = as_of ? [] : snapshotDeliveredRecords(store, envelope);
+                    // First delivery of a revision in this task earns one line; repeats stay quiet.
+                    const recalled = renderRecalledLine(unseenLessons(root, task_id, records));
                     const occurrence = recordTaskDelivery(root, task_id, envelope, records);
-                    result.content.push({ type: "text", text: `Task evidence: ${task_id} · occurrence ${occurrence}.\n${records.slice(0, 20).map(r => `${r.record_id} @ ${r.content_hash}`).join("\n")}${records.length > 20 ? "\nMore record identities: hunch_report(task_id)." : ""}` });
+                    result.content.push({ type: "text", text: `${recalled ? `${recalled}\n` : ""}Task evidence: ${task_id} · occurrence ${occurrence}.\n${records.slice(0, 20).map(r => `${r.record_id} @ ${r.content_hash}`).join("\n")}${records.length > 20 ? "\nMore record identities: hunch_report(task_id)." : ""}` });
                 }
                 catch {
                     result.content.push({ type: "text", text: `Task evidence could not be recorded for ${task_id}. Context remains available; this delivery's report attribution is unverified. Check the task ID, working directory, and local ledger.` });

package/dist/mcp/taskReportTools.d.ts

@@ -1,3 +1,188 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { readTaskReport } from "../core/taskReport.js";
 import type { HunchStore } from "../store/hunchStore.js";
+/** A tool result must fit the host's round-trip. The full report (every
+ * envelope's context text, every lesson) belongs to `hunch report --json` and
+ * the HTML view; MCP returns exact identities, verdicts and the card. Bounded
+ * by caps first, then by byte size (fnd_53991b877b: an 18-delivery task
+ * produced a 101 KB result the host refused). */
+export declare const MCP_REPORT_BYTE_BUDGET = 48000;
+export declare function boundedTaskReport(report: ReturnType<typeof readTaskReport>, deliveries?: number, recordsPerDelivery?: number): {
+    schema: "hunch.task-report-summary/1";
+    task: {
+        task_id: string;
+        scope: string;
+        title: string;
+        started_at: string;
+        finished_at: string | null;
+        state: "open" | "completed" | "interrupted";
+    };
+    coverage: "delivered" | "no-delivery-observed" | "no-relevant-memory";
+    content_hash: string;
+    unknowns: string[];
+    deliveries: {
+        occurrence_id: string;
+        receipt_id: string;
+        at: string;
+        envelope_hash: string;
+        delivered: number;
+        abstention: boolean;
+        records: {
+            record_id: string;
+            kind: string;
+            content_hash: string;
+            title: string;
+        }[];
+        more_records: number;
+    }[];
+    claims: {
+        action: string;
+        occurrence_id: string;
+        record_id: string;
+        content_hash: string;
+        at: string;
+        attribution: "agent-reported";
+        supported_by: string | null;
+    }[];
+    checks: {
+        check_id: string | undefined;
+        label: string;
+        command: string[];
+        exit_code: number | null;
+        timed_out: boolean;
+        cancelled: boolean;
+        current: boolean;
+        at: string;
+    }[];
+    conformance: {
+        record_id: string;
+        kind: "decisions" | "constraints";
+        content_hash: string;
+        rule: "constraint-forbids" | "decision-conformance";
+        outcome: "satisfied" | "violated" | "not-exercised" | "unavailable";
+        current: boolean;
+        files: string[];
+        detail: string;
+    }[];
+    saves: {
+        event_id: string;
+        at: string;
+        record_id: string;
+        kind: string;
+        content_hash: string;
+        title: string;
+        home: "public" | "private";
+        operation: "updated" | "created";
+        durability: "committed" | "pushed" | "local";
+    }[];
+    refusals: ({
+        source: "native-edit-gate";
+        outcome: "denial-emitted";
+        kind: "constraint" | "veto";
+        record_id: string;
+        target: string;
+        reason_hash: string;
+    } & {
+        event_id: string;
+        at: string;
+    })[];
+    omitted: {
+        deliveries: number;
+        claims: number;
+        checks: number;
+        conformance: number;
+        saves: number;
+        refusals: number;
+    };
+    full_report: string;
+};
+export declare function boundedTaskReportForHost(report: ReturnType<typeof readTaskReport>): {
+    schema: "hunch.task-report-summary/1";
+    task: {
+        task_id: string;
+        scope: string;
+        title: string;
+        started_at: string;
+        finished_at: string | null;
+        state: "open" | "completed" | "interrupted";
+    };
+    coverage: "delivered" | "no-delivery-observed" | "no-relevant-memory";
+    content_hash: string;
+    unknowns: string[];
+    deliveries: {
+        occurrence_id: string;
+        receipt_id: string;
+        at: string;
+        envelope_hash: string;
+        delivered: number;
+        abstention: boolean;
+        records: {
+            record_id: string;
+            kind: string;
+            content_hash: string;
+            title: string;
+        }[];
+        more_records: number;
+    }[];
+    claims: {
+        action: string;
+        occurrence_id: string;
+        record_id: string;
+        content_hash: string;
+        at: string;
+        attribution: "agent-reported";
+        supported_by: string | null;
+    }[];
+    checks: {
+        check_id: string | undefined;
+        label: string;
+        command: string[];
+        exit_code: number | null;
+        timed_out: boolean;
+        cancelled: boolean;
+        current: boolean;
+        at: string;
+    }[];
+    conformance: {
+        record_id: string;
+        kind: "decisions" | "constraints";
+        content_hash: string;
+        rule: "constraint-forbids" | "decision-conformance";
+        outcome: "satisfied" | "violated" | "not-exercised" | "unavailable";
+        current: boolean;
+        files: string[];
+        detail: string;
+    }[];
+    saves: {
+        event_id: string;
+        at: string;
+        record_id: string;
+        kind: string;
+        content_hash: string;
+        title: string;
+        home: "public" | "private";
+        operation: "updated" | "created";
+        durability: "committed" | "pushed" | "local";
+    }[];
+    refusals: ({
+        source: "native-edit-gate";
+        outcome: "denial-emitted";
+        kind: "constraint" | "veto";
+        record_id: string;
+        target: string;
+        reason_hash: string;
+    } & {
+        event_id: string;
+        at: string;
+    })[];
+    omitted: {
+        deliveries: number;
+        claims: number;
+        checks: number;
+        conformance: number;
+        saves: number;
+        refusals: number;
+    };
+    full_report: string;
+};
 export declare function registerTaskReportTools(server: McpServer, getRoot: () => string, getStore: () => HunchStore): void;

package/dist/mcp/taskReportTools.js

@@ -6,6 +6,47 @@ import { renderTaskReport, writeTaskReportHtml } from "../core/taskReportRender.
 function applicationReferences(report) {
     return report.deliveries.flatMap(d => d.records.map(r => ({ occurrence_id: d.occurrence_id, record_id: r.record_id, content_hash: r.content_hash, title: r.title }))).slice(-100);
 }
+/** A tool result must fit the host's round-trip. The full report (every
+ * envelope's context text, every lesson) belongs to `hunch report --json` and
+ * the HTML view; MCP returns exact identities, verdicts and the card. Bounded
+ * by caps first, then by byte size (fnd_53991b877b: an 18-delivery task
+ * produced a 101 KB result the host refused). */
+export const MCP_REPORT_BYTE_BUDGET = 48_000;
+export function boundedTaskReport(report, deliveries = 30, recordsPerDelivery = 25) {
+    const clip = (s, n) => (s.length > n ? `${s.slice(0, n - 1)}…` : s);
+    const tail = (items, n) => items.slice(Math.max(0, items.length - n));
+    return {
+        schema: "hunch.task-report-summary/1",
+        task: report.task, coverage: report.coverage, content_hash: report.content_hash, unknowns: report.unknowns,
+        deliveries: tail(report.deliveries, deliveries).map(d => ({
+            occurrence_id: d.occurrence_id, receipt_id: d.receipt_id, at: d.at, envelope_hash: d.envelope_hash,
+            delivered: d.envelope.delivered.length, abstention: d.envelope.abstention.active,
+            records: d.records.slice(0, recordsPerDelivery).map(r => ({ record_id: r.record_id, kind: r.kind, content_hash: r.content_hash, title: clip(r.title, 160) })),
+            more_records: Math.max(0, d.records.length - recordsPerDelivery),
+        })),
+        claims: tail(report.claims, 20).map(c => ({ ...c, action: clip(c.action, 300) })),
+        checks: tail(report.checks, 30).map(c => ({ check_id: c.check_id, label: c.label, command: c.command.map(x => clip(x, 120)), exit_code: c.exit_code, timed_out: c.timed_out, cancelled: c.cancelled ?? false, current: c.current, at: c.at })),
+        conformance: tail(report.conformance, 50).map(r => ({ record_id: r.record_id, kind: r.kind, content_hash: r.content_hash, rule: r.rule, outcome: r.outcome, current: r.current, files: r.files.slice(0, 8), detail: clip(r.detail, 240) })),
+        saves: tail(report.saves, 30).map(s => ({ event_id: s.event_id, at: s.at, record_id: s.record.record_id, kind: s.record.kind, content_hash: s.record.content_hash, title: clip(s.record.title, 160), home: s.home, operation: s.operation, durability: s.durability })),
+        refusals: tail(report.refusals, 30),
+        omitted: {
+            deliveries: Math.max(0, report.deliveries.length - deliveries), claims: Math.max(0, report.claims.length - 20), checks: Math.max(0, report.checks.length - 30),
+            conformance: Math.max(0, report.conformance.length - 50), saves: Math.max(0, report.saves.length - 30), refusals: Math.max(0, report.refusals.length - 30),
+        },
+        full_report: `hunch report ${report.task.task_id} --json`,
+    };
+}
+export function boundedTaskReportForHost(report) {
+    // Shrink deterministically until the summary fits; identities are never dropped
+    // from what remains, and `omitted` says exactly how much fell off.
+    for (const [deliveries, records] of [[30, 25], [10, 10], [5, 5], [1, 5], [1, 1]]) {
+        const summary = boundedTaskReport(report, deliveries, records);
+        if (JSON.stringify(summary).length <= MCP_REPORT_BYTE_BUDGET)
+            return summary;
+    }
+    const minimal = boundedTaskReport(report, 1, 1);
+    return { ...minimal, deliveries: [], omitted: { ...minimal.omitted, deliveries: report.deliveries.length } };
+}
 /** Reuse the MCP server's installation, not a potentially stale global binary.
  * Structured argv is authoritative; the shell hint uses literal quoting. */
 function verificationLauncher() {
@@ -34,7 +75,7 @@ export function registerTaskReportTools(server, getRoot, getStore) {
                     throw new Error("start requires a short task title and no completion evidence");
                 const task = startReportTask(root, title, task_id);
                 const launcher = verificationLauncher();
-                return { content: [{ type: "text", text: `Task ${task.task_id} · ${task.state}. Pass task_id to every hunch_context and decision/correction/finding capture call. Before the final response, finish with hunch_task and include its contribution card. For checks use this exact installation (the global hunch binary may be stale): ${launcher.shell} task verify ${task.task_id} -- <command> [arguments].` }], structuredContent: { task, verification_argv: [...launcher.argv, "task", "verify", task.task_id, "--"] } };
+                return { content: [{ type: "text", text: `Task ${task.task_id} · ${task.state}. Pass task_id to every hunch_context and decision/correction/finding capture call. Before the final response, finish with hunch_task and include its contribution card. For checks use this exact installation (the global hunch binary may be stale): ${launcher.shell} task verify ${task.task_id} -- <command> [arguments]. The default budget is 2 minutes; add --timeout <seconds> before -- for a long suite.` }], structuredContent: { task, verification_argv: [...launcher.argv, "task", "verify", task.task_id, "--"] } };
             }
             if (!task_id)
                 throw new Error("finish requires the exact task_id");
@@ -57,7 +98,7 @@ export function registerTaskReportTools(server, getRoot, getStore) {
             }
             catch { /* retained report remains inspectable through MCP */ }
             const card = file ? renderTaskReport(report).replace(/^Evidence .*$/m, `Evidence  [Open local report](<${file}>)`) : renderTaskReport(report);
-            return { content: [{ type: "text", text: show ? card : "Task report retained. Automatic presentation is disabled; omit the contribution card from the final response." }], structuredContent: { ...report, presentation_enabled: show, contribution_card: show ? card : null, report_path: file } };
+            return { content: [{ type: "text", text: show ? card : "Task report retained. Automatic presentation is disabled; omit the contribution card from the final response." }], structuredContent: { ...boundedTaskReportForHost(report), presentation_enabled: show, contribution_card: show ? card : null, report_path: file } };
         }
         catch (error) {
             const message = `Task report unavailable: ${error.message}`;
@@ -75,7 +116,7 @@ export function registerTaskReportTools(server, getRoot, getStore) {
     });
     server.registerTool("hunch_report", {
         title: "Inspect the evidence for Hunch's contribution to a task",
-        description: "Read task reports: exact delivered memory, agent-reported applications, observed command results and explicit unknowns. Supply lesson for exact revision history across tasks. With neither task_id nor lesson, lists recent tasks without guessing which is yours. html writes a local private evidence view. Not a causal impact score, public export, or authority to execute verification commands.",
+        description: "Read task reports: exact delivered memory, agent-reported applications, observed command results and explicit unknowns, as a bounded summary (identities and verdicts, not envelope text; the full report is `hunch report <id> --json`). Supply lesson for exact revision history across tasks. With neither task_id nor lesson, lists recent tasks without guessing which is yours. html writes a local private evidence view. Not a causal impact score, public export, or authority to execute verification commands.",
         inputSchema: { task_id: TaskIdSchema.optional(), lesson: LessonReferenceSchema.optional().describe("Exact kind and record_id, optionally content_hash, to inspect retained appearances across tasks. Partial indexing requires refreshing before pagination."), before: z.number().int().positive().optional(), html: z.boolean().optional(), cwd: z.string().optional() },
     }, async ({ task_id, lesson, before, html }) => {
         try {
@@ -96,7 +137,7 @@ export function registerTaskReportTools(server, getRoot, getStore) {
             }
             const report = readTaskReport(root, task_id, reportSourceSnapshot(root).hash);
             const file = html ? writeTaskReportHtml(root, task_id) : null;
-            return { content: [{ type: "text", text: `${renderTaskReport(report)}${file ? `\nLocal evidence view: ${file}` : ""}` }], structuredContent: { ...report, application_references: applicationReferences(report), contribution_card: renderTaskReport(report), report_path: file } };
+            return { content: [{ type: "text", text: `${renderTaskReport(report)}${file ? `\nLocal evidence view: ${file}` : ""}` }], structuredContent: { ...boundedTaskReportForHost(report), application_references: applicationReferences(report), contribution_card: renderTaskReport(report), report_path: file } };
         }
         catch (error) {
             return { isError: true, content: [{ type: "text", text: `Invalid: ${error.message}` }] };

package/dist/taskReports.d.ts

@@ -1,5 +1,6 @@
 import { type ReportClaim, type ReportRecord, type LessonReference } from "./core/taskReport.js";
 import { runReportCheck } from "./core/taskReportEvidence.js";
+export { DEFAULT_CHECK_TIMEOUT_MS, MAX_CHECK_TIMEOUT_MS } from "./core/taskReportEvidence.js";
 import type { DeliveryEnvelope } from "./core/delivery.js";
 export type { TaskReport, ReportTask, ReportClaim, ReportCheck, ReportConformance, ReportSave, ReportDurability, ReportRefusal, ReportRecord, TaskDelivery, LessonReference, LessonHistory } from "./core/taskReport.js";
 export { TASK_REPORT_SCHEMA, TaskIdSchema } from "./core/taskReport.js";
@@ -28,7 +29,9 @@ export declare function createTaskReporter(root: string): {
     applied(taskId: string, claim: ReportClaim): string;
     /** Runs locally as argv, without a shell. Only use commands authorized by
      * the task owner. This API does not accept remote claimed-success receipts. */
-    verify(taskId: string, command: string[], label: string, options?: Parameters<typeof runReportCheck>[5]): Promise<{
+    verify(taskId: string, command: string[], label: string, options?: Parameters<typeof runReportCheck>[5] & {
+        timeoutMs?: number;
+    }): Promise<{
         label: string;
         command: string[];
         exit_code: number | null;

package/dist/taskReports.js

@@ -3,7 +3,8 @@
 import { realpathSync } from "node:fs";
 import { z } from "zod";
 import { finishReportTask, listReportTasks, readTaskReport, readLessonHistory, recordReportClaim, recordTaskDelivery, reportHash, reportPresentationEnabled, startReportTask } from "./core/taskReport.js";
-import { reportSourceSnapshot, runReportCheck, runReportConformance } from "./core/taskReportEvidence.js";
+import { DEFAULT_CHECK_TIMEOUT_MS, reportSourceSnapshot, runReportCheck, runReportConformance } from "./core/taskReportEvidence.js";
+export { DEFAULT_CHECK_TIMEOUT_MS, MAX_CHECK_TIMEOUT_MS } from "./core/taskReportEvidence.js";
 import { renderTaskReport, writeTaskReportHtml } from "./core/taskReportRender.js";
 import { hunchPaths } from "./core/paths.js";
 import { HunchStore } from "./store/hunchStore.js";
@@ -34,7 +35,8 @@ export function createTaskReporter(root) {
         /** Runs locally as argv, without a shell. Only use commands authorized by
          * the task owner. This API does not accept remote claimed-success receipts. */
         verify(taskId, command, label, options) {
-            return runReportCheck(scope, taskId, command, label, 120_000, options);
+            const { timeoutMs = DEFAULT_CHECK_TIMEOUT_MS, ...rest } = options ?? {};
+            return runReportCheck(scope, taskId, command, label, timeoutMs, rest);
         },
         /** Hunch evaluates each delivered lesson's declared rule against the changed
          * files. Deterministic and local; the harness supplies no verdict. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.32.0",
+  "version": "1.32.2",
   "mcpName": "io.github.davesheffer/hunch",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://www.hunchmemory.com",
-  "version": "1.32.0",
+  "version": "1.32.2",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@davesheffer/hunch",
-      "version": "1.32.0",
+      "version": "1.32.2",
       "runtimeHint": "npx",
       "packageArguments": [
         {