@davesheffer/hunch 1.39.1 → 1.39.2

package/dist/cli/index.js

@@ -102,10 +102,11 @@ import { loadGoldenSet, evaluateRetrieval, evaluateTraversalLift } from "../eval
 import { loadGuardCases, evalGuards, generateGuardCases } from "../eval/guards.js";
 import { DRIFT_KINDS, computeDrift } from "../core/drift.js";
 import { renderCompilerScorecard, scoreCompilerCaseBank } from "../constitution/scorecard.js";
-import { generateWiki, wikiStatus, wikiPrompt, publicHome, privateHome, readWikiManifestAt, nowData } from "../wiki/wiki.js";
+import { generateWiki, wikiStatus, wikiPrompt, publicHome, privateHome, readWikiManifestAt, nowData, unconfirmedRoadmapMarker } from "../wiki/wiki.js";
 import { adoptProsePrompt } from "../wiki/adopt.js";
 import { topicCollisions, isInForce, liveForTopic } from "../core/topics.js";
 import { ADR_DIR_CANDIDATES, ADR_FILE_RE, mapAdrCorpus } from "../extractors/adrImport.js";
+import { countersignConstraint, countersignDecision } from "../core/countersign.js";
 import { applyImportedAdrReview, carryImportedAdrReview, importedAdrReviewHash, importedAdrSourceHash, isImportedAdrDecision, pendingImportedAdrReviews } from "../core/importReview.js";
 import { exportMadrCorpus, isRegenerableMadr } from "../integrations/madrExport.js";
 import { buildMadrManifest, writeMadrManifest, refreshMadrCorpus } from "../integrations/madrManifest.js";
@@ -5042,7 +5043,10 @@ program
                         L.push(`  ${r.date} [${r.status}] ${r.title} (${r.id})`);
                 }
                 if (roadmap.length) {
-                    L.push(`Roadmap (${roadmap.length} live proposed): ${roadmap.slice(0, 3).map((r) => r.title).join(" · ")}${roadmap.length > 3 ? " · …" : ""}`);
+                    L.push(`Roadmap (${roadmap.length} live proposed): ${roadmap.slice(0, 3).map((r) => (r.unconfirmed ? `${r.title} [unconfirmed, ${r.id}]` : r.title)).join(" · ")}${roadmap.length > 3 ? " · …" : ""}`);
+                    const unconfirmed = roadmap.filter((r) => r.unconfirmed).length;
+                    if (unconfirmed)
+                        L.push(`${unconfirmed} roadmap item(s) are unconfirmed agent testimony — the human confirms each with \`hunch review --confirm <id>${s.unified ? " --private" : ""}\`.`);
                 }
                 if (pendingReview > 0)
                     L.push(`${pendingReview} legacy un-vouched draft(s) — adopt as advisory memory with \`hunch adopt-drafts\` (new captures auto-trust).`);
@@ -5358,6 +5362,8 @@ program
     .description("Answer hash-bound imported-ADR questions, or triage deliberate proposed drafts.")
     .option("--accept <id>", "promote a decision to accepted/human-confirmed (confirms its tripwires)")
     .option("--reject <id>", "reject a draft decision with a durable lifecycle tombstone")
+    .option("--confirm <id>", "countersign an agent-recorded decision (dec_…) or correction (con_…) as human-confirmed WITHOUT changing its status or content — the human act a capture token alone cannot stand in for")
+    .option("--severity <s>", "with --confirm on a correction: the severity you grant (advisory | warning | blocking); default keeps its current severity")
     .option("--approve-import <id>", "approve one exact imported ADR as human-confirmed authority")
     .option("--decline-import <id>", "record that one exact imported ADR was reviewed and must stay advisory")
     .option("--expected-source-hash <hash>", "exact sha256 source hash printed with the imported-ADR question")
@@ -5374,11 +5380,15 @@ program
         store.close();
         return fail("--private needs HUNCH_PRIVATE_DIR set to a private store");
     }
-    const actionCount = [opts.accept, opts.reject, opts.approveImport, opts.declineImport, opts.acceptVerified, opts.rejectDuplicates].filter(Boolean).length;
+    const actionCount = [opts.accept, opts.reject, opts.confirm, opts.approveImport, opts.declineImport, opts.acceptVerified, opts.rejectDuplicates].filter(Boolean).length;
     if (actionCount > 1) {
         store.close();
         return fail("choose exactly one review action at a time");
     }
+    if (opts.severity && !opts.confirm) {
+        store.close();
+        return fail("--severity applies only with --confirm on a correction");
+    }
     const decisions = () => opts.private ? store.recs("decisions") : store.json.loadAll("decisions");
     let publicGroundingChanged = false;
     const touchedHomes = new Set();
@@ -5418,6 +5428,58 @@ program
             return fail(error instanceof Error ? error.message : String(error));
         }
     }
+    else if (opts.confirm) {
+        // Human countersign of agent testimony. A capture token proves only that the
+        // interview tool was called (inside the agent's channel), so agent-written records
+        // land as agent_recorded; this is the out-of-channel human act that signs them.
+        // Content and status are untouched: confirming a proposed decision is not shipping it.
+        const id = opts.confirm;
+        const SEV = ["advisory", "warning", "blocking"];
+        if (opts.severity && !SEV.includes(opts.severity)) {
+            store.close();
+            return fail(`--severity must be one of: ${SEV.join(", ")}`);
+        }
+        const now = new Date().toISOString();
+        const d = opts.private ? store.getRec("decisions", id) : store.json.get("decisions", id);
+        const c = d ? undefined : opts.private ? store.getRec("constraints", id) : store.json.get("constraints", id);
+        if (!d && !c) {
+            store.close();
+            return fail(`no decision or constraint ${id} found${opts.private ? "" : " in the public home (add --private for overlay records)"}`);
+        }
+        let home;
+        if (d) {
+            if (opts.severity) {
+                store.close();
+                return fail("--severity applies only when confirming a correction (con_…), not a decision");
+            }
+            if (isImportedAdrDecision(d)) {
+                store.close();
+                return fail(`imported ADR ${d.id} requires the hash-bound --approve-import flow shown by hunch review`);
+            }
+            home = opts.private ? decisionMemoryHome(store, d.id) : "public";
+            putDecisionInHome(store, countersignDecision(d, now), home);
+            console.log(`✓ confirmed decision ${id} as human_confirmed (status ${d.status} unchanged)`);
+        }
+        else {
+            home = opts.private && store.getPrivateRec("constraints", id) ? "private" : "public";
+            const next = countersignConstraint(c, now, opts.severity);
+            if (home === "private")
+                store.putPrivate("constraints", next);
+            else
+                store.json.put("constraints", next);
+            const repoWide = next.scope.length === 1 && next.scope[0] === "**";
+            console.log(`✓ confirmed ${next.severity} constraint ${id} as human_confirmed (scope: ${next.scope.join(", ")})`);
+            if (next.severity === "blocking" && repoWide)
+                console.log("  ⚠ repo-wide blocking rule: it can deny any edit at strict firmness and fail hunch check --strict.");
+        }
+        touchedHomes.add(home);
+        store.reindex();
+        if (home === "public") {
+            publicGroundingChanged = true;
+            if (!store.autoCommit)
+                refreshExistingGrounding(root, store);
+        }
+    }
     else if (opts.accept) {
         const d = opts.private ? store.getRec("decisions", opts.accept) : store.json.get("decisions", opts.accept);
         if (!d) {
@@ -5541,7 +5603,7 @@ program
                 if (dupCount)
                     console.log(`\n   Batch-reject the ${dupCount} duplicate(s): hunch review --reject-duplicates`);
             }
-            console.log(`\nAccept: hunch review --accept <id>   Reject: hunch review --reject <id>`);
+            console.log(`\nAccept: hunch review --accept <id>   Reject: hunch review --reject <id>   Confirm (sign, keep status): hunch review --confirm <id>`);
         }
     }
     if (touchedHomes.size)
@@ -6741,7 +6803,7 @@ program
         if (!roadmap.length)
             console.log("  (empty — record what's next as a PROPOSED decision via /capture and it appears here)");
         for (const r of roadmap)
-            console.log(`  • ${r.title}  (${r.id}${r.topic ? `, ${r.topic}` : ""}, since ${r.date})\n      ${r.note}`);
+            console.log(`  • ${r.title}  (${r.id}${r.topic ? `, ${r.topic}` : ""}, since ${r.date})${r.unconfirmed ? `\n      ${unconfirmedRoadmapMarker(r, { private: !!opts.private })}` : ""}\n      ${r.note}`);
         if (pendingReview > 0)
             console.log(`\n  (${pendingReview} legacy un-vouched draft(s) — \`hunch adopt-drafts\` to auto-trust them as advisory)`);
         // Task-record ranking: evaluated automatically on every task write; the kill rule applies itself.

package/dist/client/state.d.ts

@@ -306,11 +306,12 @@ export declare function createStateClient(opts: StateClientOptions): {
         missing: string[];
         denied: string[];
     }>;
+    /** Liveness; `partitions` is present because this client sends its credential. */
     health: () => Promise<{
         ok: boolean;
         version: string;
         protocol: string;
-        partitions: string[];
+        partitions?: string[];
     }>;
 };
 export type StateClient = ReturnType<typeof createStateClient>;

package/dist/client/state.js

@@ -59,6 +59,7 @@ export function createStateClient(opts) {
         captureBatch: (request) => call("POST", "/nuryel/v1/capture-batch", request),
         subscribe: (request) => call("POST", "/nuryel/v1/subscribe", request),
         records: (request) => call("POST", "/nuryel/v1/records", request),
+        /** Liveness; `partitions` is present because this client sends its credential. */
         health: () => call("GET", "/nuryel/v1/health"),
     };
 }

package/dist/core/agenthook.js

@@ -152,8 +152,12 @@ function toolOutput(value) {
 }
 function explicitToolOutcome(response) {
     const raw = obj(response);
+    // A bare string carries no status. Codex sends a Bash call's raw output this
+    // way, without its exit code, and a failing test run prints output as readily
+    // as a passing one. Status-looking text inside it ("Exit code: 0") is output
+    // the command itself can print, so it is never parsed as a status either.
     if (!raw)
-        return typeof response === "string" && response.trim() ? "success" : "unknown";
+        return "unknown";
     if (raw.success === false || raw.is_error === true || raw.isError === true || (raw.error !== undefined && raw.error !== null))
         return "failure";
     const status = raw.status;
@@ -176,8 +180,8 @@ function explicitToolOutcome(response) {
     if (explicitSuccess)
         return "success";
     // Common successful tool-result shapes carry output fields even when the
-    // output is empty. An unstructured empty string (Codex's native failure
-    // payload) remains unknown until the host supplies an explicit status.
+    // output is empty (Claude Code routes failed calls to PostToolUseFailure
+    // instead). An unstructured string remains unknown (see above).
     if (["stdout", "stderr", "output", "content"].some(key => Object.prototype.hasOwnProperty.call(raw, key)))
         return "success";
     return "unknown";

package/dist/core/capturetoken.d.ts

@@ -3,10 +3,18 @@
  *
  * hunch_capture_decision issues a short-lived token; the commit path consumes it, so a
  * decision written through the capture front door is provably the tail of an interview
- * — the identity-principle guard against a silent, un-interviewed write. In-memory (the
- * MCP server is long-lived); tokens are one-time-use and expire so an abandoned
- * interview can't leak. Absence of a token never BLOCKS a write yet (staged
+ * PROTOCOL — the identity-principle guard against a silent, un-interviewed write.
+ * In-memory (the MCP server is long-lived); tokens are one-time-use and expire so an
+ * abandoned interview can't leak. Absence of a token never BLOCKS a write yet (staged
  * deprecation §9.3) — the caller decides how to treat an un-gated write.
+ *
+ * WHAT A TOKEN DOES NOT PROVE: that a human answered. Any agent — or content steering
+ * one — can call hunch_capture_decision and consume the token it gets back, entirely
+ * inside the agent's own MCP channel. So a consumed token never confers
+ * `human_confirmed` on its own (the stamp the strict gate and the edit hook trust). It
+ * only licenses ASKING the human through a channel the agent does not control: an MCP
+ * elicitation answered in the client UI (`isHumanConfirmationAnswer`), or a human
+ * running `hunch review --confirm <id>`. Without one of those, the write is testimony.
  */
 declare const CAPTURE_TOKEN_TTL_MS: number;
 /** Issue a token stamped `now` (epoch ms). Prunes expired tokens first so the map can't
@@ -16,4 +24,23 @@ export declare function issueCaptureToken(mint: () => string, now: number): stri
 /** Consume a token iff it is a live, unexpired capture session. One-time use: a second
  *  consume of the same token returns false. */
 export declare function consumeCaptureToken(token: string | undefined, now: number): boolean;
+/** The form a human answers in the client UI (MCP `elicitation/create`, form mode). One
+ *  required boolean, so a bare "accept" (an empty submit) is never read as a yes. */
+export declare const HUMAN_CONFIRMATION_SCHEMA: {
+    type: "object";
+    properties: {
+        confirm: {
+            type: "boolean";
+            title: string;
+            description: string;
+        };
+    };
+    required: string[];
+};
+/** Did the human affirmatively confirm? Only an explicit accept WITH confirm === true
+ *  counts; decline, cancel, and a missing or false checkbox all mean "no signature". */
+export declare function isHumanConfirmationAnswer(result: {
+    action?: string;
+    content?: Record<string, unknown>;
+} | null | undefined): boolean;
 export { CAPTURE_TOKEN_TTL_MS };

package/dist/core/capturetoken.js

@@ -3,10 +3,18 @@
  *
  * hunch_capture_decision issues a short-lived token; the commit path consumes it, so a
  * decision written through the capture front door is provably the tail of an interview
- * — the identity-principle guard against a silent, un-interviewed write. In-memory (the
- * MCP server is long-lived); tokens are one-time-use and expire so an abandoned
- * interview can't leak. Absence of a token never BLOCKS a write yet (staged
+ * PROTOCOL — the identity-principle guard against a silent, un-interviewed write.
+ * In-memory (the MCP server is long-lived); tokens are one-time-use and expire so an
+ * abandoned interview can't leak. Absence of a token never BLOCKS a write yet (staged
  * deprecation §9.3) — the caller decides how to treat an un-gated write.
+ *
+ * WHAT A TOKEN DOES NOT PROVE: that a human answered. Any agent — or content steering
+ * one — can call hunch_capture_decision and consume the token it gets back, entirely
+ * inside the agent's own MCP channel. So a consumed token never confers
+ * `human_confirmed` on its own (the stamp the strict gate and the edit hook trust). It
+ * only licenses ASKING the human through a channel the agent does not control: an MCP
+ * elicitation answered in the client UI (`isHumanConfirmationAnswer`), or a human
+ * running `hunch review --confirm <id>`. Without one of those, the write is testimony.
  */
 const CAPTURE_TOKEN_TTL_MS = 30 * 60 * 1000; // 30 min
 const sessions = new Map(); // token -> issuedAt (epoch ms)
@@ -32,5 +40,23 @@ export function consumeCaptureToken(token, now) {
     sessions.delete(token);
     return now - at <= CAPTURE_TOKEN_TTL_MS;
 }
+/** The form a human answers in the client UI (MCP `elicitation/create`, form mode). One
+ *  required boolean, so a bare "accept" (an empty submit) is never read as a yes. */
+export const HUMAN_CONFIRMATION_SCHEMA = {
+    type: "object",
+    properties: {
+        confirm: {
+            type: "boolean",
+            title: "I confirm this myself",
+            description: "Check only if YOU stated this. Unchecked, it is kept as agent testimony that cannot block.",
+        },
+    },
+    required: ["confirm"],
+};
+/** Did the human affirmatively confirm? Only an explicit accept WITH confirm === true
+ *  counts; decline, cancel, and a missing or false checkbox all mean "no signature". */
+export function isHumanConfirmationAnswer(result) {
+    return result?.action === "accept" && result.content?.confirm === true;
+}
 export { CAPTURE_TOKEN_TTL_MS };
 //# sourceMappingURL=capturetoken.js.map

package/dist/core/correction.d.ts

@@ -25,12 +25,18 @@ export interface CorrectionInput {
      *  consumer matches repo-relative paths — so without this an absolute hint mints a
      *  scope that can never match. */
     root?: string;
-    /** True when a capture token was CONSUMED for this write — proof a grilling interview
-     *  preceded it. Determines the TIER, never whether the write lands: an un-vouched
-     *  correction still records immediately and still surfaces at edit time and in CI.
-     *  Only the authority to DENY waits for a countersign. */
+    /** True only when a HUMAN confirmed this write outside the agent's channel (an MCP
+     *  elicitation answered in the client UI). A consumed capture token alone is NOT
+     *  enough — any agent can mint and consume one. Determines the TIER, never whether
+     *  the write lands: an un-vouched correction still records immediately and still
+     *  surfaces at edit time and in CI. Only the authority to DENY waits for a countersign
+     *  (`hunch review --confirm <id>`). */
     vouched?: boolean;
 }
+/** Default rationales, exported so a later human countersign can replace the testimony
+ *  wording without touching a rationale a person actually wrote. */
+export declare const VOUCHED_CORRECTION_RATIONALE = "Captured from a human correction of the agent (Never Twice).";
+export declare const TESTIMONY_CORRECTION_RATIONALE = "Recorded by the agent as a correction, without a human confirmation \u2014 advisory testimony until a human countersigns it (`hunch review --confirm`) (Never Twice).";
 /**
  * Build the Constraint a correction mints. Pure (caller passes `now`), so the
  * scope/severity policy is testable in isolation. Key safety rule (research

package/dist/core/correction.js

@@ -41,6 +41,10 @@ export const CORRECTION_NUDGE = "This looks like a correction. If it's a rule th
     "call hunch_record_correction({ rule, scope_hint_file, severity, applies_to_all }) so it " +
     "becomes an enforced, scoped constraint (held at edit-time and in CI) — not a one-off the next session forgets. " +
     "Use severity:\"blocking\" only when the human said never/must; set applies_to_all:true only if the rule is genuinely repo-wide.";
+/** Default rationales, exported so a later human countersign can replace the testimony
+ *  wording without touching a rationale a person actually wrote. */
+export const VOUCHED_CORRECTION_RATIONALE = "Captured from a human correction of the agent (Never Twice).";
+export const TESTIMONY_CORRECTION_RATIONALE = "Recorded by the agent as a correction, without a human confirmation — advisory testimony until a human countersigns it (`hunch review --confirm`) (Never Twice).";
 /** Normalize a scope hint to a repo-relative POSIX path.
  *
  *  An ABSOLUTE hint is the shape an agent naturally sends, but `checkConstraints`
@@ -94,7 +98,8 @@ export function buildCorrectionConstraint(input, now) {
     // the highest-authority write path the least gated one, and strictly worse than
     // hunch_record_decision, which only ever produced advisory memory and is now tiered.
     //
-    // The token sets the TIER, never whether the write lands. An un-vouched correction is
+    // A HUMAN confirmation sets the TIER (a capture token alone is not one — any agent can
+    // mint and consume a token), never whether the write lands. An un-vouched correction is
     // still recorded immediately and still held against every assistant at edit time and
     // in CI — Never Twice keeps its promise. What waits for a countersign is only the
     // authority to DENY.
@@ -114,9 +119,7 @@ export function buildCorrectionConstraint(input, now) {
         // rule that goes stale. Validated against the repo's real deps when supplied → never mints a
         // never-firing rule for a non-dependency. null when nothing derivable → falls back to scope.
         forbids: deriveForbids(rule, input.knownDeps),
-        rationale: input.rationale ?? (vouched
-            ? "Captured from a human correction of the agent (Never Twice)."
-            : "Recorded by the agent as a correction, WITHOUT a capture interview — advisory testimony until a human countersigns it via /capture (Never Twice)."),
+        rationale: input.rationale ?? (vouched ? VOUCHED_CORRECTION_RATIONALE : TESTIMONY_CORRECTION_RATIONALE),
         source_decision: input.source_decision ?? null,
         violations: [],
         status: "active",

package/dist/core/countersign.d.ts

@@ -0,0 +1,28 @@
+/** Human countersign: turn agent testimony into a human-confirmed record.
+ *
+ *  A capture token proves an interview protocol was issued, not that a human answered
+ *  (see capturetoken.ts), so agent-written decisions and corrections land as
+ *  `agent_recorded` testimony. This is the pure record transform behind the human act
+ *  that upgrades them — `hunch review --confirm <id>` (and, for a correction, the
+ *  severity the human grants). It never changes a record's content or status: confirming
+ *  a proposed decision is not shipping it. Pure (caller passes `now`) so it is testable. */
+import type { Constraint, Decision } from "./types.js";
+/** Is this record agent testimony awaiting a human countersign? Token-aware ("+"-joined
+ *  sources), and a record carrying a human signature is never testimony. */
+export declare function isAgentTestimony(source: string | undefined): boolean;
+/** The exact command a HUMAN runs to countersign agent testimony (outside the agent
+ *  channel). `private` targets the overlay home; `severity` grants a correction's authority. */
+export declare function confirmCommand(id: string, opts?: {
+    private?: boolean;
+    severity?: string;
+}): string;
+/** Replace the agent testimony tier with the human signature, keeping every other
+ *  "+"-joined source token ("llm_draft+agent_recorded" → "llm_draft+human_confirmed"). */
+export declare function withHumanSignature(source: string): string;
+/** Countersign a decision. Same tier + confidence the capture path grants a human-confirmed
+ *  write; status, content, and tripwires are untouched (`hunch review --accept` is the path
+ *  that ships a draft and arms its tripwires). */
+export declare function countersignDecision(d: Decision, now: string): Decision;
+/** Countersign a correction. `severity`, when given, is the authority the human grants
+ *  (an unconfirmed "blocking" request was capped to "warning"); otherwise it is kept. */
+export declare function countersignConstraint(c: Constraint, now: string, severity?: Constraint["severity"]): Constraint;

package/dist/core/countersign.js

@@ -0,0 +1,50 @@
+import { TESTIMONY_CORRECTION_RATIONALE, VOUCHED_CORRECTION_RATIONALE } from "./correction.js";
+/** Is this record agent testimony awaiting a human countersign? Token-aware ("+"-joined
+ *  sources), and a record carrying a human signature is never testimony. */
+export function isAgentTestimony(source) {
+    const tokens = (source ?? "").split("+");
+    return tokens.includes("agent_recorded") && !tokens.includes("human_confirmed");
+}
+/** The exact command a HUMAN runs to countersign agent testimony (outside the agent
+ *  channel). `private` targets the overlay home; `severity` grants a correction's authority. */
+export function confirmCommand(id, opts = {}) {
+    return `hunch review --confirm ${id}${opts.severity ? ` --severity ${opts.severity}` : ""}${opts.private ? " --private" : ""}`;
+}
+/** Replace the agent testimony tier with the human signature, keeping every other
+ *  "+"-joined source token ("llm_draft+agent_recorded" → "llm_draft+human_confirmed"). */
+export function withHumanSignature(source) {
+    const tokens = source.split("+").filter((t) => t && t !== "agent_recorded");
+    if (!tokens.includes("human_confirmed"))
+        tokens.push("human_confirmed");
+    return tokens.join("+");
+}
+/** Countersign a decision. Same tier + confidence the capture path grants a human-confirmed
+ *  write; status, content, and tripwires are untouched (`hunch review --accept` is the path
+ *  that ships a draft and arms its tripwires). */
+export function countersignDecision(d, now) {
+    return {
+        ...d,
+        provenance: {
+            ...d.provenance,
+            source: withHumanSignature(d.provenance.source),
+            confidence: Math.max(d.provenance.confidence ?? 0, 0.95),
+            last_verified: now,
+        },
+    };
+}
+/** Countersign a correction. `severity`, when given, is the authority the human grants
+ *  (an unconfirmed "blocking" request was capped to "warning"); otherwise it is kept. */
+export function countersignConstraint(c, now, severity) {
+    return {
+        ...c,
+        severity: severity ?? c.severity,
+        rationale: c.rationale === TESTIMONY_CORRECTION_RATIONALE ? VOUCHED_CORRECTION_RATIONALE : c.rationale,
+        provenance: {
+            ...c.provenance,
+            source: withHumanSignature(c.provenance.source),
+            confidence: 1,
+            last_verified: now,
+        },
+    };
+}
+//# sourceMappingURL=countersign.js.map

package/dist/core/reviewqueue.js

@@ -33,7 +33,12 @@ export const READY_MIN_GROUNDED = 0.7;
  *  explicit roadmap/intent entry a human hasn't confirmed — counts as a review draft.
  *  (Enforcement authority is granted INLINE, not by draining a background queue.) */
 export function isReviewDraft(d) {
-    return d.status === "proposed" && !d.provenance.source.includes("human_confirmed");
+    // Agent testimony (agent_recorded) is deliberate intent, not a machine draft: it shows
+    // on the roadmap marked unconfirmed, and a human confirms it with `hunch review
+    // --confirm`. Keeping it out of the draft queue keeps `adopt-drafts` / `auto-review`
+    // from accepting or rejecting it in bulk.
+    return d.status === "proposed" && !d.provenance.source.includes("human_confirmed")
+        && !d.provenance.source.split("+").includes("agent_recorded");
 }
 /** A draft is "ready to confirm" only when the Critic actually audited it (source
  *  includes "verified") AND judged it well-grounded. A high confidence number alone

package/dist/core/spawnCommand.js

@@ -9,16 +9,48 @@
  * npm/npx launchers run as plain Node scripts (no shell at all). */
 import { existsSync } from "node:fs";
 import { posix, win32 } from "node:path";
-/** cmd.exe quoting for one argument: wrap when it has whitespace or shell
- * metacharacters; double embedded quotes. Good for test/build commands; a
- * deliberately hostile argument still cannot escape because the whole line is
- * passed as one `/s /c "..."` token. */
+/** Quote one argument for a `cmd.exe /d /v:off /s /c "<line>"` launch of a
+ * batch file whose target program parses its command line with the MSVCRT
+ * rules (Node, Python, most native tools).
+ *
+ * Two parsers read the line, and a batch shim that forwards `%*` makes cmd.exe
+ * read it again, so the quoting must mean the same thing to both on every pass:
+ *
+ * - Every non-trivial argument is wrapped in quotes. An embedded quote becomes
+ *   `""` (not `\"`): MSVCRT reads `""` inside a quoted argument as one literal
+ *   quote, and cmd.exe sees two toggles, so its quote state never drifts from
+ *   the argument boundaries and `& | < > ( ) ^` always stay inside quotes.
+ *   A `\"` would look escaped to MSVCRT but end the quoted region for cmd.exe.
+ * - Backslashes are literal except before a quote, so a run of backslashes that
+ *   precedes an embedded or closing quote is doubled.
+ * - `%` expands even inside quotes. It is emitted as `"^%"`: the quote closes,
+ *   the caret escapes the percent outside quotes (cmd.exe removes the caret),
+ *   and the quote reopens. MSVCRT joins the pieces back into one argument.
+ *   Expansion of a forwarded `%*` is not rescanned, so a shim pass is safe too.
+ *
+ * A line break cannot be carried: cmd.exe ends the command at it and silently
+ * drops the rest, so such an argument is refused rather than truncated. */
 function quoteForCmd(arg) {
-    if (arg === "")
-        return '""';
-    if (!/[\s"&|<>^()%!]/.test(arg))
+    if (/[\r\n]/.test(arg))
+        throw new Error("a .cmd/.bat launcher cannot receive an argument containing a line break");
+    if (arg !== "" && /^[A-Za-z0-9_\-.:/\\@+]+$/.test(arg))
         return arg;
-    return `"${arg.replace(/"/g, '""')}"`;
+    let out = '"';
+    let backslashes = 0;
+    for (const ch of arg) {
+        if (ch === "\\") {
+            backslashes++;
+            continue;
+        }
+        if (ch === '"')
+            out += "\\".repeat(backslashes * 2) + '""';
+        else if (ch === "%")
+            out += "\\".repeat(backslashes * 2) + '"^%"';
+        else
+            out += "\\".repeat(backslashes) + ch;
+        backslashes = 0;
+    }
+    return out + "\\".repeat(backslashes * 2) + '"';
 }
 export function resolveSpawnCommand(command, options = {}) {
     const platform = options.platform ?? process.platform;
@@ -49,7 +81,7 @@ export function resolveSpawnCommand(command, options = {}) {
                 continue;
             if (/\.(cmd|bat)$/i.test(candidate)) {
                 const line = [candidate, ...args].map(quoteForCmd).join(" ");
-                return { file: env.ComSpec ?? "cmd.exe", args: ["/d", "/s", "/c", `"${line}"`], windowsVerbatimArguments: true, how: "cmd-shim" };
+                return { file: env.ComSpec ?? "cmd.exe", args: ["/d", "/v:off", "/s", "/c", `"${line}"`], windowsVerbatimArguments: true, how: "cmd-shim" };
             }
             if (ext === "" && !/\.(exe|com)$/i.test(candidate))
                 continue; // an extensionless file is not runnable on Windows

package/dist/core/stateHttp.d.ts

@@ -40,7 +40,7 @@ export declare const HttpHealthSchema: z.ZodObject<{
     ok: z.ZodBoolean;
     version: z.ZodString;
     protocol: z.ZodLiteral<"nuryel.state/1">;
-    partitions: z.ZodArray<z.ZodString>;
+    partitions: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 export declare const HttpReadResponseSchema: z.ZodObject<{
     conventions: z.ZodOptional<z.ZodObject<{

package/dist/core/stateHttp.js

@@ -6,7 +6,9 @@ export const HttpCapabilitiesSchema = CapabilityNegotiationSchema.extend({
     principal: PrincipalSchema.pick({ id: true, kind: true, grants: true }),
 }).strict();
 export const HttpHealthSchema = z.object({
-    ok: z.boolean(), version: z.string(), protocol: z.literal(STATE_CONTRACT_VERSION), partitions: z.array(z.string()),
+    ok: z.boolean(), version: z.string(), protocol: z.literal(STATE_CONTRACT_VERSION),
+    // Present only when the request carried a valid credential.
+    partitions: z.array(z.string()).optional(),
 }).strict();
 // Delivery has its own richer assertion and receipt checks in delivery.ts.
 export const HttpReadResponseSchema = ReadResponseSchema.extend({ envelope: z.record(z.string(), z.unknown()) });

package/dist/core/taskReportEvidence.js

@@ -216,9 +216,31 @@ export async function runReportCheck(root, taskId, command, label, timeoutMs = D
         // Windows launchers (npx.cmd, npm.cmd, other .cmd/.bat shims) cannot be spawned
         // without a shell; resolve them first so a check actually runs instead of
         // silently recording exit_code null (fnd: every Windows card said "no result").
-        const resolved = resolveSpawnCommand(command);
-        const child = spawn(resolved.file, resolved.args, { cwd: root, shell: false, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, detached: process.platform !== "win32", windowsVerbatimArguments: resolved.windowsVerbatimArguments === true });
         const stdout = createHash("sha256"), stderr = createHash("sha256");
+        const launchFailure = (error) => {
+            // A launch failure is a result the user must see (ENOENT is the common
+            // one); it is hashed like any other stderr and streamed to the caller.
+            const text = error instanceof Error ? error.message : String(error);
+            return Buffer.from(`hunch: could not start ${JSON.stringify(command[0])}: ${text}\n`);
+        };
+        const started = (() => {
+            try {
+                const resolved = resolveSpawnCommand(command);
+                return spawn(resolved.file, resolved.args, { cwd: root, shell: false, stdio: ["ignore", "pipe", "pipe"], windowsHide: true, detached: process.platform !== "win32", windowsVerbatimArguments: resolved.windowsVerbatimArguments === true });
+            }
+            catch (error) {
+                // An argument the launcher cannot carry, or a synchronous spawn refusal
+                // (EINVAL for a batch file), is the same visible failure as ENOENT.
+                return launchFailure(error);
+            }
+        })();
+        if (Buffer.isBuffer(started)) {
+            stderr.update(started);
+            options.onStderr?.(started);
+            resolveResult({ code: null, timedOut: false, cancelled: false, hash: reportHash({ stdout: stdout.digest("hex"), stderr: stderr.digest("hex") }) });
+            return;
+        }
+        const child = started;
         let timedOut = false, cancelled = false, settled = false;
         let cleanupTimer;
         const settle = (code) => {
@@ -267,9 +289,7 @@ export async function runReportCheck(root, taskId, command, label, timeoutMs = D
             options.onStderr?.(chunk);
         } });
         child.once("error", (error) => {
-            // A launch failure is a result the user must see (ENOENT is the common
-            // one); it is hashed like any other stderr and streamed to the caller.
-            const message = Buffer.from(`hunch: could not start ${JSON.stringify(command[0])}: ${error.message}\n`);
+            const message = launchFailure(error);
             if (!settled) {
                 stderr.update(message);
                 options.onStderr?.(message);

package/dist/core/topics.js

@@ -86,7 +86,7 @@ export function renderGrounding(fileDecisions, allDecisions = fileDecisions) {
         // Token-aware match (mirrors strictgate.isHumanConfirmed; not imported — that
         // module imports this one).
         const testimony = d.provenance.source.split("+").includes("agent_recorded")
-            ? " — ⚠ agent-recorded testimony, no human countersign yet (/capture confirms it)"
+            ? ` — ⚠ agent-recorded testimony, no human countersign yet (a human confirms it: hunch review --confirm ${d.id})`
             : "";
         return `• "${d.topic}": ${d.decision || d.title} [${d.id}]${rej}${testimony}`;
     });

package/dist/integrations/scaffold.js

@@ -80,7 +80,7 @@ Capture the decision for **$ARGUMENTS** into Hunch's graph.
 2. Run the GRILLING LOOP: one focused question at a time. Push back on hand-wavy answers. Resolve every branch before committing — an unexamined decision poisons the graph.
 3. Confirm the TOPIC anchor with me before committing. One topic per decision; if it spans two, split into two captures.
 4. Capture REJECTED alternatives explicitly (what, and why not) — this is what makes the decision enforceable (Veto/drift check against it).
-5. Commit with \`hunch_record_decision\`, passing \`capture_token\` (from step 1) and the confirmed \`topic\`. The artifact is the graph write, not prose.
+5. Commit with \`hunch_record_decision\`, passing \`capture_token\` (from step 1) and the confirmed \`topic\`. The artifact is the graph write, not prose. The token is not my signature: confirm the record in the client prompt if one appears; otherwise it stays agent testimony until I run the \`hunch review --confirm <id>\` command the response prints.
 6. On CONFLICT for the topic, do NOT auto-supersede — Hunch refuses and presents both; let me choose supersede (link) / split the topic / discard.
 `;
 const WORKTREES_CMD = `---