@davesheffer/hunch 1.7.0 → 1.8.0

package/dist/mcp/server.js

@@ -22,10 +22,14 @@ import { ensureTeamOverlay } from "../integrations/team.js";
 import { formatContext, formatStructure } from "../core/format.js";
 import { compareCandidates } from "../core/compare.js";
 import { checkConformance } from "../core/conformance.js";
+import { ConstitutionService } from "../constitution/service.js";
+import { G2_RUNBOOK_CATEGORIES } from "../constitution/g2.js";
 import { renderMarkdown, renderImpact, verdict } from "../core/checkreport.js";
 import { nowData, wikiStatus, publicHome, readWikiManifestAt } from "../wiki/wiki.js";
 import { HUNCH_VERSION } from "../core/version.js";
+import { indexRepo } from "../extractors/indexer.js";
 import { liveForTopic, historyForTopic, rejectedForTopic, captureConflicts } from "../core/topics.js";
+import { pendingEscalations, policyEscalations } from "../core/escalations.js";
 import { issueCaptureToken as issueToken, consumeCaptureToken as consumeToken } from "../core/capturetoken.js";
 import { randomUUID } from "node:crypto";
 const ok = (text) => ({ content: [{ type: "text", text }] });
@@ -338,7 +342,38 @@ export function buildServer(root) {
         for (const r of roadmap)
             L.push(`  • ${r.title} (${r.id}${r.topic ? `, ${r.topic}` : ""}, since ${r.date})\n      ${r.note}`);
         if (pendingReview > 0)
-            L.push("", `${pendingReview} auto-drafted proposal(s) awaiting review — \`hunch review\`.`);
+            L.push("", `${pendingReview} legacy un-vouched draft(s) — \`hunch adopt-drafts\` auto-trusts them as advisory (new captures land trusted automatically).`);
+        const escalations = pendingEscalations(store.json.loadAll("decisions"));
+        if (escalations.length) {
+            L.push("", `⚖ ${escalations.length} decision(s) need the human's call — ASK inline (never queue): ${escalations.map((e) => e.question).join(" · ")}`);
+        }
+        return ok(L.join("\n"));
+    });
+    // -- hunch_escalations (the inline "ask the human" surface) -----------------
+    // Captured memory auto-trusts; this returns ONLY what the graph can't resolve
+    // itself, framed as questions to raise in conversation: topic conflicts, plus the
+    // Constitution's human moments (a candidate awaiting review, a proposed policy
+    // whose activation is a human call — §59.5.3). Public store only — same
+    // jurisdiction rule as hunch_now (an assistant may paste it). Client-agnostic
+    // (con_e04226bd05): no Claude-specific behavior.
+    server.registerTool("hunch_escalations", {
+        title: "Decisions the human must make now (ask inline, not a queue)",
+        description: "The rare decisions the graph cannot resolve on its own — surfaced so you ASK THE USER in the prompt at the moment, then act. Auto-captured memory is trusted automatically and never appears here; this returns topic conflicts (>1 live decision for one topic) and Constitution human moments (candidate policies awaiting review, proposed policies awaiting an activation decision). Normally empty. Raise each question with the user; do NOT decide it for them — an entry is a question, never an approval. Public store only.",
+        inputSchema: {},
+    }, async () => {
+        const items = pendingEscalations(store.json.loadAll("decisions"));
+        try {
+            items.push(...policyEscalations(new ConstitutionService(store, root).list({ publicOnly: true }).map((p) => ({ ...p, last_action: p.audit.at(-1)?.action ?? null }))));
+        }
+        catch { /* constitution unavailable — memory escalations still surface */ }
+        if (!items.length)
+            return ok("✓ Nothing needs a human decision — memory is auto-trusted and self-consistent.");
+        const L = [`${items.length} decision(s) need the human's call — ask each inline, don't decide it for them:`, ""];
+        for (const e of items) {
+            L.push(`⚖ ${e.question}`);
+            L.push(`   ${e.detail}`);
+            L.push(`   → ${e.resolution}`, "");
+        }
         return ok(L.join("\n"));
     });
     // -- hunch_wiki_status (generated-wiki freshness) ---------------------------
@@ -723,6 +758,191 @@ export function buildServer(root) {
             return err(`Failed to compare candidates: ${e.message}`);
         }
     });
+    // -- Hunch Constitution (read-first, agent-neutral Policy IR) ------------
+    server.registerTool("hunch_policy_candidates", {
+        title: "List Constitution policy candidates",
+        description: "List compiled/proposed deterministic Policy IR candidates. Read-only; candidates carry no authority and cannot block. Uses the same Git-native policy store for every MCP client.",
+        inputSchema: {
+            public_only: z.boolean().optional().describe("Exclude the private overlay from this response."),
+        },
+    }, async ({ public_only }) => {
+        try {
+            const service = new ConstitutionService(store, root);
+            const candidates = service.list({ publicOnly: public_only }).filter((p) => p.state === "compiled" || p.state === "validating" || p.state === "proposed");
+            if (!candidates.length)
+                return ok("No Constitution policy candidates.");
+            return ok(JSON.stringify(candidates.map((p) => ({ id: p.id, state: p.state, statement: p.statement, proof: p.proof, data_class: p.data_class })), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to list policy candidates: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_policy_plan", {
+        title: "Generate or inspect a Constitution proof plan",
+        description: "Return the canonical Git-native ProofPlan for a policy candidate: immutable source/current commits, known-good/bad corpus, mutation operators, expectations, and budgets. Planning executes no replay, model, test, or authority transition.",
+        inputSchema: {
+            policy_id: z.string().describe("Policy id (pol_*)."),
+            public_only: z.boolean().optional().describe("Exclude private-overlay policy and evidence records."),
+        },
+    }, async ({ policy_id, public_only }) => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).plan(policy_id, { publicOnly: public_only }), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to generate policy proof plan: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_policy_card", {
+        title: "Inspect a Constitution proof card",
+        description: "Return the deterministic proof-card view for a policy: exact assertion/scope, raw evidence vector, uncertainty, blocking readiness, authority, limitations, and next actions. Read-only and grants no authority.",
+        inputSchema: {
+            policy_id: z.string().describe("Policy id (pol_*)."),
+            public_only: z.boolean().optional().describe("Exclude private-overlay policy and proof records."),
+        },
+    }, async ({ policy_id, public_only }) => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).card(policy_id, { publicOnly: public_only }), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to build policy proof card: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_policy_shadow", {
+        title: "Inspect Constitution shadow precision",
+        description: "Return the append-only shadow evaluation ledger, current human dispositions, raw precision counts, unknown/error rate, thresholds, and P4-review recommendation for one policy. Read-only: it never records a sample, changes lifecycle, activates, warns, or blocks.",
+        inputSchema: {
+            policy_id: z.string().describe("Policy id (pol_*)."),
+            public_only: z.boolean().optional().describe("Exclude private-overlay shadow records."),
+        },
+    }, async ({ policy_id, public_only }) => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).shadowReport(policy_id, {}, { publicOnly: public_only }), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to inspect policy shadow precision: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_policy_proof", {
+        title: "Inspect a Constitution policy proof",
+        description: "Return the full content-addressed proof artifact for a policy. Read-only; exposes baseline, mutations, proof class, artifact hashes, and limitations without changing authority.",
+        inputSchema: {
+            policy_id: z.string().describe("Policy id (pol_*)."),
+            public_only: z.boolean().optional().describe("Exclude the private overlay from this response."),
+        },
+    }, async ({ policy_id, public_only }) => {
+        try {
+            const service = new ConstitutionService(store, root);
+            const policy = service.get(policy_id, { publicOnly: public_only });
+            if (!policy.proof)
+                return ok(`Policy ${policy_id} has no proof yet.`);
+            return ok(JSON.stringify(service.proof(policy.proof, { publicOnly: public_only }), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to read policy proof: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_policy_evaluate", {
+        title: "Evaluate Constitution policy",
+        description: "Evaluate one or all deterministic Policy IR records and return canonical neutral receipts (satisfied, violated, not_applicable, unknown, error). This is the same evaluator used by CLI and strict CI; models never decide the verdict.",
+        inputSchema: {
+            policy_id: z.string().optional().describe("Optional policy id; omit for all policies."),
+            active_only: z.boolean().optional().describe("Evaluate only active advisory/blocking policies."),
+            public_only: z.boolean().optional().describe("Exclude private-overlay policies and graph records."),
+            workspace: z.enum(["staged", "working"]).optional().describe("For executable-behavior policies, evaluate the staged index or complete working snapshot in a disposable checkout."),
+            commit: z.string().optional().describe("For executable-behavior policies, evaluate an exact commit ref instead of the current committed HEAD."),
+        },
+    }, async ({ policy_id, active_only, public_only, workspace, commit }) => {
+        try {
+            if (workspace && commit)
+                throw new Error("choose either workspace or commit for executable-behavior evaluation");
+            if (commit && !revExists(commit, root))
+                throw new Error(`commit ref ${JSON.stringify(commit)} does not resolve`);
+            indexRepo(store, root, { churn: false });
+            store.reindex();
+            const behavior = workspace ? { workspace }
+                : commit ? { commit: revParse(commit, root) }
+                    : undefined;
+            const receipts = new ConstitutionService(store, root)
+                .evaluate({ id: policy_id, activeOnly: active_only, publicOnly: public_only, behavior })
+                .map((r) => r.evaluation);
+            return ok(JSON.stringify(receipts, null, 2));
+        }
+        catch (e) {
+            return err(`Failed to evaluate policy: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_constitution_g2_readiness", {
+        title: "Inspect Constitution G2 readiness",
+        description: "Return the exact private G2 dogfood evidence packet: human-selected policies, bound proof/corpus/shadow evidence, operational runbook rehearsals, and blockers. Read-only; it never creates evidence, signs off G2, activates policy, warns, or blocks.",
+        inputSchema: {},
+    }, async () => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).g2Readiness(), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to inspect G2 readiness: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_constitution_g3_readiness", {
+        title: "Inspect Constitution G3 readiness",
+        description: "Return the exact private G3 advisory packet: human-selected policies and clients, immutable experiment preregistrations, proof-card comprehension/review measurements, executable adapter conformance, scorecard, and blockers. Read-only; it never records evidence, activates policy, or signs off G3.",
+        inputSchema: {},
+    }, async () => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).g3Readiness(), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to inspect G3 readiness: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_constitution_g2_shadow_queue", {
+        title: "Review unclassified G2 shadow violations",
+        description: "Return a bounded private queue of exact-current-proof G2 shadow violations that still require human classification. Read-only; it never records an observation or disposition, changes lifecycle, grants authority, warns, or blocks.",
+        inputSchema: {
+            limit: z.number().int().min(1).max(100).optional().describe("Maximum queue items to return (default 20)."),
+        },
+    }, async ({ limit }) => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).g2ShadowQueue(limit ?? 20), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to inspect the G2 shadow queue: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_constitution_g2_operational_drill", {
+        title: "Execute one exact G2 operational drill",
+        description: "Execute the selected private G2 runbook's exact safety regression and return a content-addressed hash-only receipt. Diagnostic only: it writes no rehearsal or shadow evidence, grants no authority, and never signs off G2.",
+        inputSchema: {
+            category: z.enum(G2_RUNBOOK_CATEGORIES).describe("Exact operational category selected by the current private G2 plan."),
+        },
+    }, async ({ category }) => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).g2OperationalDrill(category), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to execute the G2 operational drill: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_constitution_g2_candidates", {
+        title: "Review potential G2 dogfood candidates",
+        description: "Return a bounded private review packet of exact structural candidates from fix-labeled git history, including the current append-only human selection/rejection when present. Read-only: proposed before/after corpus refs are not replayed evidence, and the tool creates no attestation, policy, proof, corpus, authority, warning, or block.",
+        inputSchema: {
+            since: z.string().min(1).max(100).optional().describe("Git history window (default 180d)."),
+            max_commits: z.number().int().min(1).max(200).optional().describe("Maximum fix-labeled commits to inspect (default 100)."),
+            limit: z.number().int().min(1).max(100).optional().describe("Maximum ranked candidates to return (default 30)."),
+        },
+    }, async ({ since, max_commits, limit }) => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).g2CandidateReview({
+                since: since ?? "180d",
+                maxCommits: max_commits ?? 100,
+                limit: limit ?? 30,
+            }), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to inspect G2 candidates: ${e.message}`);
+        }
+    });
     // -- hunch_conformance ----------------------------------------------------
     server.registerTool("hunch_conformance", {
         title: "Does the code still satisfy the recorded intent?",
@@ -737,6 +957,102 @@ export function buildServer(root) {
         const head = violations.length ? `⛔ ${violations.length} intent(s) the code no longer satisfies` : "✅ the code satisfies every recorded intent";
         return ok(`Intent-conformance (${results.length - violations.length}/${results.length} satisfied):\n\n${lines.join("\n")}\n\n${head}`);
     });
+    server.registerTool("hunch_constitution_g2_behavior_candidates", {
+        title: "Review executable G2 behavior candidates",
+        description: "Derive a bounded private review packet from human-grounded rejected structural proxies and newly added literal node:test cases in their exact fixing commits. Read-only: candidates remain unselected and create no policy, corpus, proof, authority, warning, or block.",
+        inputSchema: {
+            decision_id: z.string().regex(/^dec_[A-Za-z0-9_-]+$/).optional().describe("Exact current human-confirmed decision to use as the direct behavior grounding batch."),
+            since: z.string().min(1).max(100).optional().describe("Git history window (default 180d)."),
+            max_commits: z.number().int().min(1).max(200).optional().describe("Maximum fix-labeled commits to inspect (default 100)."),
+            limit: z.number().int().min(1).max(100).optional().describe("Maximum behavior candidates to return (default 30)."),
+        },
+    }, async ({ decision_id, since, max_commits, limit }) => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).g2BehaviorCandidateReview({
+                since: since ?? "180d",
+                maxCommits: max_commits ?? 100,
+                limit: limit ?? 30,
+                decisionId: decision_id,
+            }), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to inspect G2 behavior candidates: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_constitution_g2_behavior_replay", {
+        title: "Replay one G2 behavior candidate",
+        description: "Execute one exact behavior candidate without a shell in disposable known-bad and known-good worktrees, transplanting the hash-bound known-good test file into both. Diagnostic only: writes no Constitution artifact and grants no policy or G2 authority.",
+        inputSchema: {
+            candidate_id: z.string().regex(/^g2behavior_[a-f0-9]{10}$/),
+            review_hash: z.string().regex(/^sha1:[a-f0-9]{40}$/),
+            decision_id: z.string().regex(/^dec_[A-Za-z0-9_-]+$/).optional().describe("Exact decision batch used by the reviewed candidate."),
+            since: z.string().min(1).max(100).optional().describe("Git history window used by the exact review packet (default 180d)."),
+            max_commits: z.number().int().min(1).max(200).optional().describe("Fix-commit bound used by the exact review packet (default 100)."),
+            limit: z.number().int().min(1).max(100).optional().describe("Item limit used by the exact review packet (default 30)."),
+            timeout_ms: z.number().int().min(1).max(120000).optional().describe("Per-leg execution timeout (default 30000ms)."),
+        },
+    }, async ({ candidate_id, review_hash, decision_id, since, max_commits, limit, timeout_ms }) => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).g2BehaviorCandidateReplay(candidate_id, review_hash, {
+                since: since ?? "180d",
+                maxCommits: max_commits ?? 100,
+                limit: limit ?? 30,
+                decisionId: decision_id,
+                timeoutMs: timeout_ms ?? 30_000,
+            }), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to replay G2 behavior candidate: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_constitution_g2_behavior_materialization", {
+        title: "Assess selected G2 behavior materialization",
+        description: "Bind the complete current private behavior review and exact selected attestations, then report whether their durable meanings are expressible by the supported Policy IR. Read-only and fail-closed: unsupported behavior creates no policy, corpus, plan, proof, authority, warning, or block.",
+        inputSchema: {
+            decision_id: z.string().regex(/^dec_[A-Za-z0-9_-]+$/).optional().describe("Exact decision batch to assess."),
+            since: z.string().min(1).max(100).optional().describe("Git history window used by the exact review packet (default 180d)."),
+            max_commits: z.number().int().min(1).max(200).optional().describe("Fix-commit bound used by the exact review packet (default 100)."),
+            limit: z.number().int().min(1).max(100).optional().describe("Item limit used by the exact review packet (default 30)."),
+        },
+    }, async ({ decision_id, since, max_commits, limit }) => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).g2BehaviorMaterializationAssessment({
+                since: since ?? "180d",
+                maxCommits: max_commits ?? 100,
+                limit: limit ?? 30,
+                decisionId: decision_id,
+            }), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to assess G2 behavior materialization: ${e.message}`);
+        }
+    });
+    server.registerTool("hunch_constitution_g2_behavior_policy_materialize", {
+        title: "Materialize selected G2 behavior policies",
+        description: "Materialize every current exact selected behavior attestation into a separate private Policy IR v2 proposal, exact corpus and plan, and P3 executable proof. Writes private non-authoritative artifacts only; activation remains a separate explicit human action.",
+        inputSchema: {
+            decision_id: z.string().regex(/^dec_[A-Za-z0-9_-]+$/).optional().describe("Exact decision batch to materialize."),
+            since: z.string().min(1).max(100).optional().describe("Git history window used by the complete exact review packet (default 180d)."),
+            max_commits: z.number().int().min(1).max(200).optional().describe("Fix-commit bound used by the exact review packet (default 100)."),
+            limit: z.number().int().min(1).max(100).optional().describe("Item limit used by the exact review packet (default 30)."),
+            allow_install_scripts: z.array(z.string().min(1).max(214)).max(20).optional().describe("Exact dependency package names allowed to run lifecycle scripts while provisioning snapshots."),
+            dependency_timeout_ms: z.number().int().min(1).max(900000).optional().describe("Timeout for each exact dependency snapshot operation (default 300000ms)."),
+        },
+    }, async ({ decision_id, since, max_commits, limit, allow_install_scripts, dependency_timeout_ms }) => {
+        try {
+            return ok(JSON.stringify(new ConstitutionService(store, root).g2BehaviorPolicyMaterialize({
+                since: since ?? "180d",
+                maxCommits: max_commits ?? 100,
+                limit: limit ?? 30,
+                decisionId: decision_id,
+                allowInstallScripts: allow_install_scripts ?? [],
+                dependencyTimeoutMs: dependency_timeout_ms ?? 300_000,
+            }), null, 2));
+        }
+        catch (e) {
+            return err(`Failed to materialize G2 behavior policies: ${e.message}`);
+        }
+    });
     return server;
 }
 function provLine(record) {

package/dist/synthesis/synthesize.js

@@ -149,7 +149,14 @@ export async function syncCommit(store, root, sha, opts = {}) {
         // Auto-synthesized decisions are un-anchored (topic null) — a topic is a human
         // act, never a machine guess. Preserve one an earlier human capture attached.
         topic: existing?.topic ?? null,
-        status: existing?.status === "accepted" ? "accepted" : "proposed",
+        // Auto-trust model: captured memory enters the graph LIVE (accepted = in-force
+        // advisory), never a `proposed` draft rotting in a review queue. It grounds and
+        // ranks immediately but NEVER blocks — the source stays llm_draft, so the veto /
+        // strict gates (which key on human_confirmed, not status) treat it as advisory
+        // and its tripwires stay unarmed until a human vouches INLINE (dec_a466655539
+        // intact). An existing human status (a deliberate `proposed` roadmap entry, or a
+        // `superseded` record) is preserved — re-sync never clobbers a human's intent.
+        status: existing?.status ?? "accepted",
         context: draft.context + constraintNote,
         decision: draft.decision,
         consequences: draft.consequences,