@davesheffer/hunch 1.4.1 → 1.5.0

package/dist/extractors/git.js

@@ -2,7 +2,7 @@
  *  No LLM here — just parsing what git already knows. */
 import { execFileSync } from "node:child_process";
 import { isAbsolute, resolve, join, basename, dirname } from "node:path";
-import { mkdirSync, rmSync, statSync, realpathSync } from "node:fs";
+import { mkdirSync, rmSync, statSync, realpathSync, readFileSync } from "node:fs";
 function git(args, cwd, maxBuffer = 64 * 1024 * 1024) {
     // stdio: capture stdout, silence stderr (so "no commits yet" etc. don't leak).
     return execFileSync("git", args, {
@@ -377,6 +377,14 @@ export function stagedFiles(cwd) {
     const out = gitSafe(["diff", "--cached", "--name-only", "--diff-filter=ACMR"], cwd);
     return out ? out.split("\n").filter(Boolean) : [];
 }
+/** Files changed anywhere in the working tree compared with HEAD: both staged
+ * and unstaged tracked files, plus untracked files. This powers the local,
+ * pre-commit Change Gate; it never mutates the index or asks an agent/model. */
+export function workingFiles(cwd) {
+    const changed = gitSafe(["diff", "HEAD", "--name-only", "--diff-filter=ACMR"], cwd).split("\n").filter(Boolean);
+    const untracked = gitSafe(["ls-files", "--others", "--exclude-standard"], cwd).split("\n").filter(Boolean);
+    return [...new Set([...changed, ...untracked])].sort();
+}
 /** Does a ref resolve to a commit in this repo? Lets `--base` fail LOUDLY on an
  *  unfetched/typo'd ref instead of silently diffing against nothing (a vacuous
  *  CI pass), since the diff helpers below swallow git errors to "". */
@@ -408,6 +416,28 @@ export function stagedDiff(cwd, maxBytes = 60_000) {
     const out = gitSafe(["diff", "--cached", "--no-color", "--unified=2", "--", ...DIFF_NOISE], cwd);
     return out.length > maxBytes ? out.slice(0, maxBytes) + "\n…(diff truncated)…" : out;
 }
+/** Unified diff of the complete local working tree vs HEAD. Git's normal diff
+ * includes both staged and unstaged tracked edits; untracked text files are
+ * appended as synthetic additions so guards can also see their added symbols.
+ * Binary/unreadable files remain in workingFiles (scope checks still apply) but
+ * intentionally contribute no synthetic content to regression analysis. */
+export function workingDiff(cwd, maxBytes = 60_000) {
+    let out = gitSafe(["diff", "HEAD", "--no-color", "--unified=2", "--", ...DIFF_NOISE], cwd);
+    const tracked = new Set(gitSafe(["diff", "HEAD", "--name-only", "--diff-filter=ACMR"], cwd).split("\n").filter(Boolean));
+    const untracked = gitSafe(["ls-files", "--others", "--exclude-standard"], cwd).split("\n").filter((f) => f && !tracked.has(f));
+    for (const file of untracked) {
+        try {
+            const text = readFileSync(join(cwd, file), "utf8");
+            if (text.includes("\0"))
+                continue;
+            const lines = text.split("\n");
+            const add = lines.map((line) => `+${line}`).join("\n");
+            out += `${out ? "\n" : ""}diff --git a/${file} b/${file}\nnew file mode 100644\n--- /dev/null\n+++ b/${file}\n@@ -0,0 +1,${lines.length} @@\n${add}\n`;
+        }
+        catch { /* unreadable / directory / binary: scope-only is still safe */ }
+    }
+    return out.length > maxBytes ? out.slice(0, maxBytes) + "\n…(diff truncated)…" : out;
+}
 /** Resolve a time-travel ref (commit / tag / branch / HEAD~n) to the ISO author-
  *  date of that commit — the instant valid-time windows are filtered against.
  *  Undefined if it can't be resolved (not a git repo, or an unknown ref). Single

package/dist/integrations/hooks.js

@@ -20,6 +20,10 @@ function block(invocation, opts = {}) {
         MARK,
         'if [ -z "$HUNCH_SYNC" ]; then',
         "  export HUNCH_SYNC=1",
+        // A split-private capture must not make a storage-private promise and then
+        // ship the commit diff to a subscription CLI. Shared overlays are a separate
+        // team policy, so only the explicit local-only mode forces deterministic.
+        ...(opts.localOnly ? ["  export HUNCH_SYNTH_PROVIDER=deterministic"] : []),
         `  ( ${invocation} sync --from-hook --quiet${priv}${commit} >/dev/null 2>&1 || true ) &`,
         "fi",
         ENDMARK,

package/dist/mcp/server.js

@@ -16,7 +16,7 @@ import { decisionId } from "../core/ids.js";
 import { buildCorrectionConstraint } from "../core/correction.js";
 import { knownRepoDeps } from "../synthesis/tripwires.js";
 import { refreshExistingGrounding } from "../integrations/providers.js";
-import { revParse, asOfDate, revExists, lastChangeDate, rangeFiles, rangeDiff, commitFiles, commitDiff, stagedFiles, stagedDiff, pullHunch } from "../extractors/git.js";
+import { revParse, asOfDate, revExists, lastChangeDate, rangeFiles, rangeDiff, commitFiles, commitDiff, stagedFiles, stagedDiff, workingFiles, workingDiff, pullHunch } from "../extractors/git.js";
 import { flushCapture } from "../integrations/sync.js";
 import { ensureTeamOverlay } from "../integrations/team.js";
 import { formatContext, formatStructure } from "../core/format.js";
@@ -446,11 +446,11 @@ export function buildServer(root) {
             const resolved = decision.commit ? revParse(decision.commit, root) : null;
             const fullSha = resolved && /^[0-9a-f]{40}$/.test(resolved) ? resolved : null;
             const id = fullSha ? decisionId(fullSha) : decisionId(`manual:${decision.title}`);
-            // Preserve the ADR lineage: upgrading an auto-draft yields the composite
-            // provenance the design specifies.
-            // Public-only lookup; skip it for a private write so a private decision never
-            // inherits fields from a same-id PUBLIC record (and vice-versa).
-            const existing = decision.private ? undefined : store.json.get("decisions", id);
+            // Preserve the ADR lineage from the SAME home this write will use. A private
+            // re-record must retain its own optional fields, but must never inherit a
+            // same-id public record (and vice versa).
+            const home = store.captureHome(!!decision.private);
+            const existing = home === "private" ? store.getPrivateRec("decisions", id) : store.json.get("decisions", id);
             const source = existing && existing.provenance.source.includes("llm_draft")
                 ? "llm_draft+human_confirmed"
                 : "human_confirmed";
@@ -482,7 +482,6 @@ export function buildServer(root) {
             // private:false, so the guard must key its incumbent lookup on HOME, not on
             // the flag — keying on the flag let a shared-mode supersede of a public
             // incumbent pass the guard and then no-op the close (two live decisions).
-            const home = store.captureHome(!!decision.private);
             // Decision-grounding uniqueness guard (§4 Enforcement): never create a SECOND
             // live decision for one topic. Exclude ONLY the incumbent this write will
             // actually close — one resolvable in the SAME store the write lands in. A
@@ -571,7 +570,7 @@ export function buildServer(root) {
             // Private corrections go to the overlay (enforced locally via the merged read,
             // never rendered into the public CI comment, which is public-only by construction).
             const home = store.captureHome(!!input.private);
-            const existing = home === "private" ? undefined : store.json.get("constraints", rec.id);
+            const existing = home === "private" ? store.getPrivateRec("constraints", rec.id) : store.json.get("constraints", rec.id);
             if (home === "private")
                 store.putPrivate("constraints", rec);
             else
@@ -600,24 +599,25 @@ export function buildServer(root) {
     // -- hunch_merge_verdict (Causal Merge Verdict — read-only, client-agnostic) --
     server.registerTool("hunch_merge_verdict", {
         title: "Causal merge verdict: is this change safe against the recorded WHY?",
-        description: "Before opening or merging a PR, replay a diff against engineering memory and return ONE verdict — BLOCK / WARN / PASS. For each invariant DIRECTLY in scope it cites WHY the guard exists (the decision that motivated it + the bug whose root cause spawned it); it also lists invariants reached via blast radius (near, advisory), any deliberately-retired code the diff re-introduces, and symbols the diff adds that are already defined elsewhere in the graph (possible re-implementation/sprawl, advisory). Deterministic, no LLM. Omit base AND commit to check STAGED changes; pass base (e.g. origin/main) for a PR range, or commit for a single commit. Call this before merging a widely-scoped change.",
+        description: "Before opening or merging a PR, replay a diff against engineering memory and return ONE verdict — BLOCK / WARN / PASS. For each invariant DIRECTLY in scope it cites WHY the guard exists (the decision that motivated it + the bug whose root cause spawned it); it also lists invariants reached via blast radius (near, advisory), any deliberately-retired code the diff re-introduces, and symbols the diff adds that are already defined elsewhere in the graph (possible re-implementation/sprawl, advisory). Deterministic, no LLM. Omit base, commit, and working to check STAGED changes; pass working:true for all local changes, base (e.g. origin/main) for a PR range, or commit for a single commit. Call this before merging a widely-scoped change.",
         inputSchema: {
             base: z.string().optional().describe("Diff against this base ref (e.g. origin/main) — for a PR/branch."),
             commit: z.string().optional().describe("Diff a single commit (sha/ref). Omit base AND commit to check staged changes."),
+            working: z.boolean().optional().describe("Include all working-tree changes vs HEAD (staged, unstaged, and untracked files)."),
         },
-    }, async ({ base, commit }) => {
+    }, async ({ base, commit, working }) => {
         try {
-            if (base && commit)
-                return err("Pass at most one of base/commit (omit both to check staged changes).");
+            if ([base, commit, working].filter(Boolean).length > 1)
+                return err("Pass at most one of base/commit/working (omit all to check staged changes).");
             if (base && !revExists(base, root))
                 return err(`base ref "${base}" does not resolve (in CI, fetch the base branch first).`);
             if (commit && !revExists(commit, root))
                 return err(`commit "${commit}" does not resolve.`);
-            const files = commit ? commitFiles(commit, root) : base ? rangeFiles(base, root) : stagedFiles(root);
-            const scope = commit ? `commit ${commit}` : base ? `${base}..HEAD` : "staged changes";
+            const files = commit ? commitFiles(commit, root) : base ? rangeFiles(base, root) : working ? workingFiles(root) : stagedFiles(root);
+            const scope = commit ? `commit ${commit}` : base ? `${base}..HEAD` : working ? "working changes" : "staged changes";
             if (!files.length)
                 return ok(`VERDICT: ✅ PASS — no changed files in ${scope}.`);
-            const diff = commit ? commitDiff(commit, root) : base ? rangeDiff(base, root) : stagedDiff(root);
+            const diff = commit ? commitDiff(commit, root) : base ? rangeDiff(base, root) : working ? workingDiff(root) : stagedDiff(root);
             const report = store.buildCheckReport(files, diff, { strict: true, lastChange: (f) => lastChangeDate(f, root) });
             const v = verdict(report);
             const head = v === "block"
@@ -642,24 +642,25 @@ export function buildServer(root) {
     // -- hunch_pr_impact (read-only impact surface — advisory, never gates) ----
     server.registerTool("hunch_pr_impact", {
         title: "PR impact: the dependency + memory surface of a change",
-        description: "Given a change (staged, a branch vs base, or a single commit), return its IMPACT SURFACE: the files whose code transitively depends on the changed files, the invariants directly in scope and those reached via blast radius, and the recorded decisions concerning the touched files. Read-only and advisory — use hunch_merge_verdict for the gate. Call before review to know what a PR can break and which recorded intent it touches. Omit base AND commit for staged changes.",
+        description: "Given a change (staged, working tree, a branch vs base, or a single commit), return its IMPACT SURFACE: the files whose code transitively depends on the changed files, the invariants directly in scope and those reached via blast radius, and the recorded decisions concerning the touched files. Read-only and advisory — use hunch_merge_verdict for the gate. Call before review to know what a PR can break and which recorded intent it touches. Omit base, commit, and working for staged changes.",
         inputSchema: {
             base: z.string().optional().describe("Diff against this base ref (e.g. origin/main) — for a PR/branch."),
             commit: z.string().optional().describe("Impact of a single commit (sha/ref). Omit base AND commit for staged changes."),
+            working: z.boolean().optional().describe("Include all working-tree changes vs HEAD (staged, unstaged, and untracked files)."),
         },
-    }, async ({ base, commit }) => {
+    }, async ({ base, commit, working }) => {
         try {
-            if (base && commit)
-                return err("Pass at most one of base/commit (omit both for staged changes).");
+            if ([base, commit, working].filter(Boolean).length > 1)
+                return err("Pass at most one of base/commit/working (omit all for staged changes).");
             if (base && !revExists(base, root))
                 return err(`base ref "${base}" does not resolve (in CI, fetch the base branch first).`);
             if (commit && !revExists(commit, root))
                 return err(`commit "${commit}" does not resolve.`);
-            const files = commit ? commitFiles(commit, root) : base ? rangeFiles(base, root) : stagedFiles(root);
-            const scope = commit ? `commit ${commit}` : base ? `${base}..HEAD` : "staged changes";
+            const files = commit ? commitFiles(commit, root) : base ? rangeFiles(base, root) : working ? workingFiles(root) : stagedFiles(root);
+            const scope = commit ? `commit ${commit}` : base ? `${base}..HEAD` : working ? "working changes" : "staged changes";
             if (!files.length)
                 return ok(`No changed files in ${scope}.`);
-            const diff = commit ? commitDiff(commit, root) : base ? rangeDiff(base, root) : stagedDiff(root);
+            const diff = commit ? commitDiff(commit, root) : base ? rangeDiff(base, root) : working ? workingDiff(root) : stagedDiff(root);
             return ok(renderImpact(store.prImpact(files, diff), scope));
         }
         catch (e) {

package/dist/store/hunchStore.js

@@ -98,6 +98,12 @@ export class HunchStore {
     getRec(kind, id) {
         return this.privateJson?.get(kind, id) ?? this.json.get(kind, id);
     }
+    /** Read a record only from the configured private overlay. Callers that must
+     *  preserve privacy boundaries (for example, an explicit `--private` repair)
+     *  should use this instead of overlay-first `getRec`. */
+    getPrivateRec(kind, id) {
+        return this.privateJson?.get(kind, id);
+    }
     /** Update an EXISTING record in the store that holds it — an overlay record must never
      *  fork a public copy on update (and vice versa). Falls back to captureHome routing for
      *  a record that exists nowhere yet. */
@@ -109,6 +115,14 @@ export class HunchStore {
             return this.json.put(kind, record);
         return this.putCapture(kind, record);
     }
+    /** Delete an existing record from its actual home. The review/curation path
+     * uses this so rejecting a private draft cannot silently leave it behind or
+     * accidentally target a public record with the same id. */
+    deleteWhereItLives(kind, id) {
+        if (this.privateJson?.get(kind, id))
+            return this.privateJson.delete(kind, id);
+        return this.json.delete(kind, id);
+    }
     /** The private-overlay config from the gitignored `.hunch/local.json` (per-machine,
      *  never committed). Tolerant: returns {} on missing/invalid so reads never crash.
      *  `autoCommit` is tri-state: true/false when the file says so, undefined when unset.
@@ -161,6 +175,12 @@ export class HunchStore {
             byId.set(r.id, r);
         return [...byId.values()];
     }
+    /** Records from exactly one storage home (no public/private union). Capture
+     * paths use this for identity/lineage checks so a private record can never
+     * inherit or disclose relationships from an identically-shaped public record. */
+    recsInHome(kind, home) {
+        return home === "private" ? (this.privateJson?.loadAll(kind) ?? []) : this.json.loadAll(kind);
+    }
     /** Whether a private overlay store is configured (HUNCH_PRIVATE_DIR is set). */
     get hasPrivate() {
         return !!this.privateJson;
@@ -883,13 +903,14 @@ export class HunchStore {
      *  lineage.spawned_constraint, else the source decision's caused_by_bug). Read-only. */
     causalChain(constraintId) {
         const out = { constraint_id: constraintId };
-        const c = this.json.get("constraints", constraintId);
+        const get = (kind, id) => this.suppressPrivate ? this.json.get(kind, id) : this.getRec(kind, id);
+        const c = get("constraints", constraintId);
         if (!c)
             return out;
-        const dec = c.source_decision ? this.json.get("decisions", c.source_decision) : null;
+        const dec = c.source_decision ? get("decisions", c.source_decision) : null;
         if (dec)
             out.decision = { id: dec.id, title: dec.title, decision: dec.decision };
-        const bugs = this.recs("bugs");
+        const bugs = this.suppressPrivate ? this.json.loadAll("bugs") : this.recs("bugs");
         // Deterministic when several bugs link one constraint (the verdict claims to be
         // deterministic): highest severity first, then lowest id — never filesystem order.
         const SEV = { critical: 3, high: 2, medium: 1, low: 0 };
@@ -1201,7 +1222,7 @@ export class HunchStore {
     /** Resolve a veto's causal citation: the bug whose root cause spawned the decision
      *  (decision → caused_by_bug). Distinct from causalChain, which is constraint-keyed. */
     vetoWhy(bugId) {
-        const bug = this.json.get("bugs", bugId);
+        const bug = this.suppressPrivate ? this.json.get("bugs", bugId) : this.getRec("bugs", bugId);
         return bug ? { bug: { id: bug.id, title: bug.title, root_cause: bug.root_cause } } : undefined;
     }
     /** Veto check for a LIVE edit (the agent pre-edit hook): no diff exists yet, so
@@ -1284,7 +1305,7 @@ export class HunchStore {
     /** Convenience: load a single entity from JSON by id (any kind). */
     resolve(id) {
         for (const kind of ENTITY_KINDS) {
-            const rec = this.json.get(kind, id);
+            const rec = this.suppressPrivate ? this.json.get(kind, id) : this.getRec(kind, id);
             if (rec)
                 return { kind, record: rec };
         }

package/dist/synthesis/provider.js

@@ -131,6 +131,20 @@ const BUG_TOOL = {
         required: ["title", "symptom", "root_cause", "severity"],
     },
 };
+const RELEVANCE_TOOL = {
+    name: "emit_relevance",
+    description: "Judge whether an auto-drafted decision is worth keeping in the memory graph.",
+    input_schema: {
+        type: "object",
+        properties: {
+            relevant: { type: "boolean", description: "true if this records a REAL, reusable design choice worth keeping. false if it is noise: a mechanical restatement of the diff, a trivial/obvious change, or content unsupported by the evidence." },
+            confidence: { type: "number", description: "0..1 confidence in the relevant call. Be honest; low when unsure." },
+            duplicate_of: { type: ["string", "null"], description: "id (dec_...) of an existing decision this merely restates, from the EXISTING DECISIONS list. null if none." },
+            reason: { type: "string", description: "one short line justifying the call." },
+        },
+        required: ["relevant", "confidence", "duplicate_of", "reason"],
+    },
+};
 const VERIFY_TOOL = {
     name: "emit_verdict",
     description: "Emit a skeptical audit of a synthesized decision against its commit.",
@@ -217,6 +231,16 @@ class CliSynthProvider {
             throw new Error(`${this.name}: no usable verdict JSON in output`);
         return verdict;
     }
+    /** Judge whether an auto-drafted decision is worth keeping (for auto-review).
+     *  Same subscription-only run() path (API keys stripped). Throws on unusable
+     *  output so the caller can degrade to a keep-for-human verdict. */
+    async judgeDraft(draft, existing) {
+        const text = await this.run(`${RELEVANCE_SYSTEM}\n\n${relevancePrompt(draft, existing)}\n\n${jsonInstruction(RELEVANCE_TOOL.input_schema)}`);
+        const verdict = relevanceFromText(text);
+        if (!verdict)
+            throw new Error(`${this.name}: no usable relevance JSON in output`);
+        return verdict;
+    }
 }
 // A model id comes from a HUNCH_*_MODEL env var and ends up as an argv token that,
 // on Windows, pexecIn joins into the cmd.exe line (shell:true, to resolve the npm
@@ -607,6 +631,40 @@ function verifyPrompt(input, draft) {
         `\nReturn grounded (0..1) and the VERBATIM alternatives_rejected / consequences the evidence does NOT support.`,
     ].filter(Boolean).join("\n\n");
 }
+const RELEVANCE_SYSTEM = `You are a strict curator for an Engineering Memory OS. You are given ONE auto-drafted
+decision and a list of decisions ALREADY in the graph. Decide if the draft is worth keeping:
+a REAL, reusable design choice (an architectural or policy decision a future engineer would
+want to know). Mark it NOT relevant if it merely restates what the diff mechanically did, is
+trivial/obvious, or is a near-duplicate of an existing decision (name that decision's id in
+duplicate_of). When genuinely unsure, keep it (relevant=true, low confidence) — deletion is
+destructive.`;
+function relevancePrompt(draft, existing) {
+    const ex = existing.length
+        ? existing.map((e) => `  ${e.id}: ${e.title} — ${e.decision.slice(0, 160)}`).join("\n")
+        : "  (none)";
+    return [
+        `DRAFT UNDER REVIEW (id ${draft.id}):`,
+        `  title: ${draft.title}`,
+        `  decision: ${(draft.decision ?? "").slice(0, 800)}`,
+        (draft.alternatives_rejected ?? []).length ? `  alternatives_rejected:\n${(draft.alternatives_rejected ?? []).map((a) => `    - ${a}`).join("\n")}` : "",
+        (draft.related_files ?? []).length ? `  related_files: ${(draft.related_files ?? []).join(", ")}` : "",
+        `\nEXISTING DECISIONS (candidates for duplicate_of):\n${ex}`,
+        `\nReturn relevant, confidence (0..1), duplicate_of (an existing id or null), and a one-line reason.`,
+    ].filter(Boolean).join("\n\n");
+}
+/** Map model text → RelevanceVerdict, or null when nothing usable parses (→ the
+ *  caller keeps the draft for a human). Tolerant of missing/loose fields. */
+export function relevanceFromText(text) {
+    for (const obj of extractJsonObjects(text)) {
+        if (typeof obj.relevant !== "boolean")
+            continue; // the one required signal
+        const dup = typeof obj.duplicate_of === "string" && obj.duplicate_of.trim() ? obj.duplicate_of.trim() : null;
+        const conf = typeof obj.confidence === "number" ? clamp01(obj.confidence) : 0.5;
+        const reason = typeof obj.reason === "string" ? obj.reason.trim() : "";
+        return { relevant: obj.relevant, confidence: conf, duplicate_of: dup, reason };
+    }
+    return null;
+}
 /** Map model text → VerifyVerdict, or null when nothing usable parses (→ the caller
  *  keeps the un-audited draft). Tolerant of arrays-as-strings and missing fields. */
 export function verdictFromText(text) {

package/dist/synthesis/synthesize.js

@@ -45,7 +45,11 @@ export async function syncCommit(store, root, sha, opts = {}) {
     // Seed the id from the COMMIT (stable across runs), not the LLM-generated title
     // (which varies) — so re-syncing a commit updates rather than dupes.
     const id = decisionId(meta.sha);
-    const existing = store.json.get("decisions", id);
+    // Check the store this capture WILL write to. Looking only in the public store
+    // made private/shared re-syncs re-draft the same commit and let `--force`
+    // overwrite a human-confirmed overlay decision.
+    const home = store.captureHome(!!opts.private);
+    const existing = home === "private" ? store.getPrivateRec("decisions", id) : store.json.get("decisions", id);
     // Never clobber a human-confirmed decision with a low-confidence auto-draft —
     // even under --force. Skip BEFORE synthesizing so we never pay for a draft we'd
     // throw away (the old order drafted first, then discarded it here).
@@ -85,12 +89,19 @@ export async function syncCommit(store, root, sha, opts = {}) {
     // back to the normal single-provider path when no CLI is available. Opt-in only.
     // --verify forces the LLM provider (auditing a deterministic draft is pointless) and,
     // like --deep, runs the Critic pass below. Subscription-only throughout (con_2ce3f2a547).
-    const wantVerify = !!(opts.verify || opts.deep);
-    const provider = opts.deep
-        ? (await selectEnsemble({ samples: opts.samples })) ?? await selectProvider()
-        : opts.force || opts.verify || isSignificant(meta, analysis, codeFiles)
-            ? await selectProvider()
-            : new DeterministicProvider();
+    // An explicit private capture is storage-private AND local-only by default:
+    // never send a sensitive diff to a subscription CLI just to create a draft.
+    // Shared mode remains an explicit team policy and keeps its existing provider
+    // behavior unless the caller asked for a private capture.
+    const localOnly = opts.localOnly ?? !!opts.private;
+    const wantVerify = !localOnly && !!(opts.verify || opts.deep);
+    const provider = localOnly
+        ? new DeterministicProvider()
+        : opts.deep
+            ? (await selectEnsemble({ samples: opts.samples })) ?? await selectProvider()
+            : opts.force || opts.verify || isSignificant(meta, analysis, codeFiles)
+                ? await selectProvider()
+                : new DeterministicProvider();
     const input = { subject: meta.subject, body: meta.body, files: codeFiles, diff, analysis };
     let draft = await draftDecisionSafe(provider, input);
     // The Critic pass: audit the draft against the commit, PRUNE unsupported alternatives
@@ -177,7 +188,7 @@ export async function syncCommit(store, root, sha, opts = {}) {
     return { status: "written", decision, provider: provider.name };
 }
 /** Capture a Bug from a test failure. Suspects are ranked churn×recency×fan-in. */
-export async function recordFailure(store, root, failure) {
+export async function recordFailure(store, root, failure, opts = {}) {
     const symbols = store.json.loadAll("symbols");
     const ranked = rankSuspects(symbols, failure.message);
     // Prefer symbols actually named in the failure — so unrelated failures don't
@@ -185,7 +196,10 @@ export async function recordFailure(store, root, failure) {
     const msg = failure.message.toLowerCase();
     const mentioned = ranked.filter((s) => msg.includes(s.name.toLowerCase()));
     const suspects = (mentioned.length ? mentioned : ranked).slice(0, 6);
-    const provider = await selectProvider();
+    // A private bug may contain a stack trace, customer data, or secrets. Keep the
+    // whole capture local unless the caller deliberately routes it through a shared
+    // (non-private) workflow.
+    const provider = opts.private ? new DeterministicProvider() : await selectProvider();
     const input = {
         test: failure.test,
         message: failure.message,
@@ -198,7 +212,8 @@ export async function recordFailure(store, root, failure) {
     const id = bugId(failure.test);
     // recurrence = a DIFFERENT prior bug with a similar symptom (not this same one).
     // Query text mirrors the corpus side (title+symptom+root_cause) for symmetry.
-    const prior = findRecurrence(store, `${draft.title} ${draft.symptom} ${draft.root_cause}`, id);
+    const home = store.captureHome(!!opts.private);
+    const prior = findRecurrence(store, `${draft.title} ${draft.symptom} ${draft.root_cause}`, id, home);
     const affectedFiles = [...new Set(suspects.map((s) => s.file))];
     const bug = {
         id,
@@ -223,12 +238,12 @@ export async function recordFailure(store, root, failure) {
             evidence: [`test:${failure.test}`, ...affectedFiles.slice(0, 6)],
         },
     };
-    store.putCapture("bugs", bug);
+    store.putCapture("bugs", bug, opts.private);
     // Promotion (DESIGN §4): a recurrence or a SUBSTANTIATED high-severity bug raises
     // a regression Constraint to stop it coming back, and bumps fragility.
     let constraint;
     if (shouldPromoteConstraint(draft.severity, bug.root_cause, !!prior)) {
-        constraint = promoteConstraint(store, bug);
+        constraint = promoteConstraint(store, bug, opts.private);
         bug.lineage.spawned_constraint = constraint.id;
         store.putWhereItLives("bugs", bug); // re-persist with the link, in the same home
     }
@@ -253,7 +268,7 @@ export async function captureTestRun(store, root, input) {
     }
     const results = [];
     for (const f of failures) {
-        const r = await recordFailure(store, root, f);
+        const r = await recordFailure(store, root, f, { private: input.private });
         results.push({ bug: r.bug, constraint: r.constraint });
     }
     let sha = null;
@@ -284,7 +299,7 @@ export function shouldPromoteConstraint(severity, rootCause, isRecurrence) {
     return severe && rootCause.trim().length > 0;
 }
 /** Turn a bug into an advisory regression constraint scoped to its files. */
-function promoteConstraint(store, bug) {
+function promoteConstraint(store, bug, isPrivate = false) {
     const scope = bug.affected_files.length ? bug.affected_files : ["**"];
     const statement = `Regression guard: "${bug.title}" must not recur.`;
     const con = {
@@ -304,7 +319,7 @@ function promoteConstraint(store, bug) {
         valid_to: null,
         provenance: { source: "derived", confidence: Math.min(0.9, bug.provenance.confidence + 0.2), evidence: [`bug:${bug.id}`] },
     };
-    return store.putCapture("constraints", con);
+    return store.putCapture("constraints", con, isPrivate);
 }
 /** Bump fragility on components owning the affected files. */
 function raiseFragility(store, files) {
@@ -366,13 +381,13 @@ export function salientTerms(text) {
 /** Recurrence = a DIFFERENT prior bug whose salient terms overlap strongly with
  *  this one (in-memory, no FTS/reindex dependency, threshold-gated to avoid the
  *  over-broad OR false positives). Returns the best match above threshold. */
-function findRecurrence(store, text, excludeId) {
+function findRecurrence(store, text, excludeId, home) {
     const want = salientTerms(text);
     if (want.size === 0)
         return undefined;
     let best;
     let bestScore = 0;
-    for (const b of store.json.loadAll("bugs")) {
+    for (const b of store.recsInHome("bugs", home)) {
         if (b.id === excludeId)
             continue;
         // symmetric with the query side (which now also includes root_cause)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davesheffer/hunch",
-  "version": "1.4.1",
+  "version": "1.5.0",
   "license": "Apache-2.0",
   "author": "Dave Sheffer <dave.sheffer1@gmail.com>",
   "description": "Architectural Conformance for AI-generated code: a git-native graph that deterministically blocks AI changes which break your architecture — the semantic invariants (layering, must-reach, dependency direction) pattern-SAST can't express — grounded in the decisions and bugs behind each rule, across any MCP assistant (Claude Code, Cursor, Copilot, Windsurf, Codex).",