@davesheffer/hunch 1.7.1 → 1.8.1

package/README.md

@@ -49,10 +49,40 @@ Hunch creates a local graph of:
 - **Constraints** — the invariants a change must not violate.
 - **Bug lineage** — the root cause behind fixes, recurrences, and regression guards.
 - **Architecture** — symbols, components, dependencies, blast radius, and fragility.
+  Deep code-structure parsing covers **TypeScript, JavaScript, and Python** (via a language
+  registry — each new language is one entry); the "why" layer works for any language.
 
 It then puts that context where work happens: MCP tools, the CLI, a VS Code Change Gate, git hooks,
 and an optional pull-request guard.
 
+## Memory that runs itself (v1.8)
+
+There is no review queue to manage. Hunch's memory loop is fully automated, and the rare decision
+that genuinely needs a human is asked **inline, at the moment** — never parked in a backlog:
+
+- **Auto-trust** — every captured decision enters the graph as live advisory memory the moment it
+  lands. It grounds and ranks immediately; it can never hard-block anything until a human
+  explicitly vouches for it. Migrate an old draft backlog once with `hunch adopt-drafts`.
+- **A source-control panel for memory** — the VS Code **Hunch Memory** view shows every move
+  Hunch makes (capture / adopt / supersede / prune / repair) as a timeline: click for the diff,
+  right-click to revert locally. `hunch log` is the same spine in the terminal.
+- **Inline escalations** — `hunch escalations` (and the `hunch_escalations` MCP tool) lists only
+  what the graph cannot resolve itself: a topic conflict, a candidate rule awaiting review, a
+  proposed rule ready to activate. Each entry is a question with its resolution verb. Normally
+  empty.
+- **Self-repair** — rename a file and the next sync automatically heals every decision binding,
+  tripwire scope, constraint scope, and policy selector that matched it exactly (git's own rename
+  detection, zero guessing). Repairs land as revertable timeline moves; a repaired *policy* asks
+  once, inline, for a fresh proof.
+- **Local-first by design** — memory auto-commits locally and rides your next push;
+  `hunch push` (or the panel's Approve-to-push) is the one deliberate outward step.
+
+```bash
+hunch log              # the memory timeline (what Hunch did, when, revertable)
+hunch escalations      # the decisions only you can make — normally empty
+hunch repair --apply   # heal bindings after a rename (sync does this automatically)
+```
+
 ## One graph. Every assistant. No lock-in.
 
 Hunch is agent-agnostic by design. It scaffolds MCP and grounding for Claude Code, Cursor, VS Code / Copilot,

package/dist/cli/index.js

@@ -30,13 +30,16 @@ import { indexRepo } from "../extractors/indexer.js";
 import { syncCommit, recordFailure, captureTestRun } from "../synthesis/synthesize.js";
 import { parseTestReport } from "../extractors/testreport.js";
 import { readSynthesisPreference, resolveSynthesisProvider, selectProvider, SYNTH_PREFERENCES, writeSynthesisPreference, } from "../synthesis/provider.js";
-import { isGitRepo, headSha, logSince, lastChangeDate, stagedFiles, workingFiles, commitFiles, asOfDate, stagedDiff, workingDiff, commitDiff, rangeFiles, rangeDiff, rangeSubjects, revExists, revParse, commitAndPushHunch, pullHunch, gitUntrackCached, gitCommonDir, isLinkedWorktree, mainWorktreeRoot } from "../extractors/git.js";
+import { isGitRepo, headSha, logSince, lastChangeDate, stagedFiles, workingFiles, commitFiles, asOfDate, stagedDiff, workingDiff, commitDiff, rangeFiles, rangeDiff, rangeSubjects, revExists, revParse, commitAndPushHunch, pullHunch, gitUntrackCached, gitCommonDir, isLinkedWorktree, mainWorktreeRoot, gitMemoryLog, memoryMoveDiff, revertMemoryMove, pushCurrentBranch, commitChanges } from "../extractors/git.js";
+import { parseMemoryLog } from "../core/memorylog.js";
+import { renamesOf, planRepair, repairDecision, repairConstraint } from "../core/repair.js";
+import { planPolicyRepair, repairPolicySpec } from "../constitution/repairPolicies.js";
 import { writeTeamConfig, ensureTeamOverlay, readTeamConfig } from "../integrations/team.js";
 import { runbookId, decisionId } from "../core/ids.js";
 import { deriveForbids, effectiveForbids } from "../core/constraintmatch.js";
 import { extractInlineIntent } from "../extractors/comments.js";
 import { renderText, renderMarkdown, renderImpact, reportFailsStrict } from "../core/checkreport.js";
-import { partitionReview, READY_MIN_GROUNDED } from "../core/reviewqueue.js";
+import { partitionReview, isReviewDraft, READY_MIN_GROUNDED } from "../core/reviewqueue.js";
 import { installPostCommitHook, installPreCommitHook } from "../integrations/hooks.js";
 import { ensureSharedOverlayPointer } from "../integrations/worktree.js";
 import { flushCapture } from "../integrations/sync.js";
@@ -64,6 +67,7 @@ import { renderCompilerScorecard, scoreCompilerCaseBank } from "../constitution/
 import { generateWiki, wikiStatus, wikiPrompt, publicHome, privateHome, readWikiManifestAt, nowData } from "../wiki/wiki.js";
 import { adoptProsePrompt } from "../wiki/adopt.js";
 import { topicCollisions, renderGrounding } from "../core/topics.js";
+import { pendingEscalations, policyEscalations } from "../core/escalations.js";
 import { parseDocAnchors, renderDocGrounding } from "../core/docanchors.js";
 import { compareCandidates } from "../core/compare.js";
 import { checkConformance } from "../core/conformance.js";
@@ -333,6 +337,15 @@ program
         return opts.quiet ? undefined : fail("--private/--overlay needs HUNCH_PRIVATE_DIR set to an overlay store");
     }
     store.json.ensureDirs();
+    // Self-repair rides every sync (Phase 5, §59.5): a commit's renames heal the
+    // exact-path bindings they break, silently, as a revertable `repair` move.
+    // Fail open — a repair error must never take the capture path down.
+    try {
+        const repaired = runRepair(store, root, sha ?? headSha(root), true);
+        if (repaired?.applied && !opts.quiet)
+            console.log(`  ↳ repaired ${repaired.plan.rewrites.length + repaired.policyRewrites.length} memory binding(s) after rename`);
+    }
+    catch { /* repair is best-effort; drift still surfaces anything left behind */ }
     const r = await syncCommit(store, root, sha ?? headSha(root), {
         force: opts.force,
         private: toOverlay,
@@ -994,10 +1007,18 @@ policyCmd
     .description("List Policy IR records from the public store plus the local private overlay.")
     .option("--state <state>", "filter by lifecycle state")
     .option("--public-only", "exclude private-overlay policy records")
+    .option("--json", "emit id/state/severity/statement/authority/proof/data_class as JSON (the VS Code panel's data source)")
     .action((opts) => {
     const { store, root } = storeFor();
     try {
         const policies = new ConstitutionService(store, root).list({ state: opts.state, publicOnly: opts.publicOnly });
+        if (opts.json) {
+            console.log(JSON.stringify(policies.map((p) => ({
+                id: p.id, state: p.state, severity: p.severity, statement: p.statement,
+                authority: p.authority, proof: p.proof, data_class: p.data_class, topic: p.topic,
+            }))));
+            return;
+        }
         if (!policies.length) {
             console.log("No Constitution policies found.");
             return;
@@ -1277,6 +1298,44 @@ policyCmd
         store.close();
     }
 });
+policyCmd
+    .command("withdraw")
+    .description("Targeted advisory withdrawal: pull the human authority back (active_advisory → proposed). The policy stops surfacing as an active rule and re-enters the inline escalation loop. History retained.")
+    .argument("<id>", "policy id")
+    .requiredOption("--actor <identity>", "explicit human identity: human:, github:, or git:")
+    .requiredOption("--reason <reason>", "audited withdrawal reason")
+    .action((id, opts) => {
+    const { store, root } = storeFor();
+    try {
+        const policy = new ConstitutionService(store, root).withdraw(id, opts.actor, opts.reason);
+        console.log(`✓ ${policy.id} withdrawn to ${policy.state}; authority returned to the human pool (revision ${policy.revision})`);
+    }
+    catch (e) {
+        fail(e.message);
+    }
+    finally {
+        store.close();
+    }
+});
+policyCmd
+    .command("retire")
+    .description("Permanently retire a policy (active or proposed → retired): it stops surfacing anywhere, its valid-time window closes, and its full history stays (supersede, never erase).")
+    .argument("<id>", "policy id")
+    .requiredOption("--actor <identity>", "explicit human identity: human:, github:, or git:")
+    .requiredOption("--reason <reason>", "audited retirement reason")
+    .action((id, opts) => {
+    const { store, root } = storeFor();
+    try {
+        const policy = new ConstitutionService(store, root).retire(id, opts.actor, opts.reason);
+        console.log(`✓ ${policy.id} retired; window closed, history retained (revision ${policy.revision})`);
+    }
+    catch (e) {
+        fail(e.message);
+    }
+    finally {
+        store.close();
+    }
+});
 policyCmd
     .command("demote")
     .description("Immediately demote an active blocking policy to advisory without erasing history.")
@@ -1927,6 +1986,46 @@ experimentCmd
         store.close();
     }
 });
+experimentCmd
+    .command("respond")
+    .description("Complete a revision-2 EXP-03 review with the standardized plain-language response: one choice, the rule you keep (accept/edit), one sentence of reasoning. Duration derives from the append-only start record; metrics are mapped deterministically — never hand-crafted.")
+    .argument("<run-id>", "immutable experiment run id")
+    .argument("<assignment-id>", "assignment returned by experiment next")
+    .requiredOption("--reviewer <actor>", "explicit human reviewer (human:name)")
+    .requiredOption("--choice <choice>", "accept | edit | reject | cannot_decide")
+    .requiredOption("--reason <text>", "one plain-language sentence")
+    .option("--rule <text>", "the rule exactly as it should be recorded (required for accept/edit)")
+    .option("--rule-file <file>", "read the rule text from a file instead of --rule")
+    .option("--inspected", "arm C only: you looked at the supporting checks before answering")
+    .option("--confirmed-private-leak", "record an independently confirmed private leak incident")
+    .option("--data-loss", "record a data loss/corruption incident")
+    .option("--unsafe-evaluator", "record unsafe evaluator behavior")
+    .action((runId, assignmentId, opts) => {
+    const { store, root } = storeFor();
+    try {
+        if (opts.rule && opts.ruleFile)
+            throw new Error("pass --rule or --rule-file, not both");
+        const rule = opts.ruleFile ? readFileSync(resolve(opts.ruleFile), "utf8") : opts.rule ?? null;
+        const service = new ConstitutionService(store, root);
+        const appended = service.respondExperimentReview(runId, assignmentId, {
+            reviewer: opts.reviewer,
+            choice: opts.choice,
+            rule_text: rule,
+            reason: opts.reason,
+            inspected_supporting_checks: !!opts.inspected,
+            confirmed_private_leak: !!opts.confirmedPrivateLeak,
+            data_loss_or_corruption: !!opts.dataLoss,
+            unsafe_evaluator_behavior: !!opts.unsafeEvaluator,
+        });
+        console.log(JSON.stringify({ appended, report: service.experimentReport(runId) }, null, 2));
+    }
+    catch (e) {
+        fail(e.message);
+    }
+    finally {
+        store.close();
+    }
+});
 experimentCmd
     .command("followup")
     .description("Append the preregistered seven-day EXP-03 reversal measurement.")
@@ -2627,9 +2726,14 @@ program
     .command("firmness")
     .description("Get or set how firmly agent lifecycle hooks enforce Hunch before edits.")
     .argument("[level]", "off | advisory | firm | strict (omit to print the current level)")
-    .action((level) => {
+    .option("--json", "print the current level + choices as JSON (for the VS Code switch)")
+    .action((level, opts) => {
     const paths = hunchPaths(findRoot());
     if (!level) {
+        if (opts.json) {
+            console.log(JSON.stringify({ firmness: readConfig(paths).firmness, levels: FIRMNESS_LEVELS }));
+            return;
+        }
         console.log(`firmness: ${readConfig(paths).firmness}`);
         console.log(`levels:   ${FIRMNESS_LEVELS.join(" | ")}  (set with: hunch firmness <level>)`);
         return;
@@ -2693,7 +2797,7 @@ program
     const blocking = store.recs("constraints").filter((c) => c.status === "active" && c.severity === "blocking" && vouchedSrc(c.provenance?.source));
     const precise = blocking.filter((c) => !!effectiveForbids(c));
     const scopeOnly = blocking.filter((c) => !effectiveForbids(c));
-    const drafts = store.json.loadAll("decisions").filter((d) => d.status === "proposed" || d.provenance.confidence < 0.6);
+    const drafts = store.json.loadAll("decisions").filter(isReviewDraft);
     const { ready, scrutiny } = partitionReview(drafts, READY_MIN_GROUNDED);
     const stale = store.staleness((f) => lastChangeDate(f, root)).filter((s) => s.kind === "constraint");
     const fnote = {
@@ -2866,7 +2970,19 @@ program
                     L.push(`Roadmap (${roadmap.length} live proposed): ${roadmap.slice(0, 3).map((r) => r.title).join(" · ")}${roadmap.length > 3 ? " · …" : ""}`);
                 }
                 if (pendingReview > 0)
-                    L.push(`${pendingReview} auto-draft(s) awaiting \`hunch review\`.`);
+                    L.push(`${pendingReview} legacy un-vouched draft(s) — adopt as advisory memory with \`hunch adopt-drafts\` (new captures auto-trust).`);
+                const escalations = pendingEscalations(decisions);
+                try {
+                    // Constitution human moments ride the same line; a broken policy store
+                    // must never take session-start orientation down (fail open). Public
+                    // store only — session transcripts travel further than a terminal.
+                    const { ConstitutionService: CS } = await import("../constitution/service.js");
+                    escalations.push(...policyEscalations(new CS(s, paths.root).list({ publicOnly: true }).map((p) => ({ ...p, last_action: p.audit.at(-1)?.action ?? null }))));
+                }
+                catch { /* constitution unavailable */ }
+                if (escalations.length) {
+                    L.push(`⚖ ${escalations.length} decision(s) need YOUR call — ASK the user inline (don't queue): ${escalations.map((e) => e.question).join(" · ")}`);
+                }
                 L.push("Orient further: hunch_context(task) · hunch_structure() · `hunch now`.");
                 // The operating loop rides session start — guaranteed delivery, once
                 // (the zod bench showed ambient skills are read in ~0% of sessions).
@@ -3007,6 +3123,44 @@ function printReviewItem(it) {
     const synthLine = synth.raw ? `\n      ↳ ${synth.raw}` : "";
     console.log(`  ${d.id} [${d.status}, ${d.provenance.source} ${d.provenance.confidence}]${pruneNote}\n      ${d.title}\n      ${d.decision.slice(0, 120)}${synthLine}`);
 }
+program
+    .command("adopt-drafts")
+    .description("Auto-trust migration: adopt every legacy un-vouched proposed draft as trusted ADVISORY memory (status → accepted, source unchanged so it STILL never blocks). Clears the old review backlog in one shot — nothing is deleted, enforcement stays human-gated, and blocking authority is still granted inline. Idempotent.")
+    .option("--dry-run", "list what would be adopted; change nothing")
+    .option("--private", "include local private/shared-overlay drafts")
+    .action((opts) => {
+    const { store, root } = storeFor();
+    try {
+        if (opts.private && !store.hasPrivate)
+            return fail("--private needs HUNCH_PRIVATE_DIR set to a private store");
+        const all = opts.private ? store.recs("decisions") : store.json.loadAll("decisions");
+        const drafts = all.filter(isReviewDraft);
+        if (!drafts.length) {
+            console.log("✓ No un-vouched drafts — the graph is already fully auto-trusted.");
+            return;
+        }
+        if (opts.dryRun) {
+            console.log(`Would adopt ${drafts.length} draft(s) as trusted advisory memory (still never block):`);
+            for (const d of drafts)
+                console.log(`  ${d.id}  [${d.provenance.source} ${d.provenance.confidence}]  ${d.title}`);
+            console.log(`\n${dim("Dry run — nothing changed. Re-run without --dry-run to adopt. Roadmap intent? Re-declare it with hunch_record_decision(status:proposed).")}`);
+            return;
+        }
+        // Flip status proposed → accepted (in-force advisory). Source/confidence are
+        // UNCHANGED: it stays llm_draft-sourced, so the veto/strict gates (which key on
+        // human_confirmed, not status) keep treating it as advisory — never blocking.
+        let adopted = 0;
+        for (const d of drafts) {
+            store.putWhereItLives("decisions", { ...d, status: "accepted", provenance: { ...d.provenance, last_verified: new Date().toISOString() } });
+            adopted++;
+        }
+        store.reindex();
+        console.log(`✓ Adopted ${adopted} draft(s) as trusted advisory memory. The review backlog is clear; none of them can block an edit until a human grants blocking authority inline.`);
+    }
+    finally {
+        store.close();
+    }
+});
 program
     .command("review")
     .description("Triage drafts: segmented list, accept/reject one, or batch-accept Critic-verified drafts.")
@@ -3100,10 +3254,10 @@ program
         }
     }
     else {
-        const drafts = decisions().filter((d) => d.status === "proposed" || d.provenance.confidence < 0.6);
+        const drafts = decisions().filter(isReviewDraft);
         const { ready, scrutiny } = partitionReview(drafts, minGrounded);
         if (!ready.length && !scrutiny.length) {
-            console.log("✓ No low-confidence drafts to review.");
+            console.log("✓ No drafts awaiting review — captured memory auto-trusts (advisory) the moment it lands.");
         }
         else {
             if (ready.length) {
@@ -3154,7 +3308,7 @@ program
         const minRejectConfidence = Number.isFinite(Number(opts.minRejectConfidence)) ? Number(opts.minRejectConfidence) : 0.7;
         const all = opts.private ? store.recs("decisions") : store.json.loadAll("decisions");
         // Same draft set `hunch review` / `hunch status` triage.
-        const drafts = all.filter((d) => d.status === "proposed" || d.provenance.confidence < 0.6);
+        const drafts = all.filter(isReviewDraft);
         if (!drafts.length) {
             console.log("✓ No drafts to auto-review.");
             return;
@@ -3323,6 +3477,196 @@ program
         store.close();
     }
 });
+// ---- escalations (the inline "ask the human" surface) ---------------------
+program
+    .command("escalations")
+    .description("The decisions a human must make NOW — surfaced to be asked INLINE (in the prompt), never a background queue. Captured memory auto-trusts on landing; this lists only what the graph genuinely can't resolve itself: topic conflicts, Constitution candidates awaiting review, and proposed policies whose activation is a human call. Normally empty. Exits non-zero when any are open, so an assistant/CI knows to raise them.")
+    .option("--json", "emit the escalation entries as JSON (the VS Code panel's data source)")
+    .action(async (opts) => {
+    const { store, root } = storeFor();
+    try {
+        const items = pendingEscalations(store.recs("decisions"));
+        // Constitution moments ride the same inline surface (§59.5.3) — never a queue.
+        // Fail open: a broken policy store must not take the memory escalations down.
+        try {
+            const { ConstitutionService: CS } = await import("../constitution/service.js");
+            items.push(...policyEscalations(new CS(store, root).list().map((p) => ({ ...p, last_action: p.audit.at(-1)?.action ?? null }))));
+        }
+        catch { /* constitution unavailable — memory escalations still surface */ }
+        if (opts.json) {
+            console.log(JSON.stringify(items));
+            if (items.length)
+                process.exitCode = 1;
+            return;
+        }
+        if (!items.length) {
+            console.log("✓ Nothing needs your decision — memory is auto-trusted and self-consistent.");
+            return;
+        }
+        console.log(`${items.length} decision(s) need your call (ask inline; nothing is queued):\n`);
+        for (const e of items) {
+            console.log(`  ⚖ ${e.question}`);
+            console.log(`      ${dim(e.detail)}`);
+            console.log(`      ${dim("→ " + e.resolution)}\n`);
+        }
+        process.exitCode = 1;
+    }
+    finally {
+        store.close();
+    }
+});
+// ---- log / revert-move (the memory-move timeline — VS Code Source Control) -
+program
+    .command("log")
+    .description("The memory-move timeline: every commit that changed .hunch/ (capture/adopt/supersede/prune), newest first. --json powers the VS Code Hunch Source Control view.")
+    .option("--json", "emit the moves as JSON for tooling")
+    .option("-n, --limit <n>", "max moves to show", "100")
+    .option("--diff <sha>", "print one move's .hunch/ diff (the click-through), instead of the list")
+    .action((opts) => {
+    const root = findRoot();
+    if (!isGitRepo(root))
+        return fail("not a git repo — the memory timeline needs git history.");
+    if (opts.diff) {
+        process.stdout.write(memoryMoveDiff(opts.diff, root));
+        return;
+    }
+    const limit = Number.isFinite(Number(opts.limit)) ? Number(opts.limit) : 100;
+    const moves = parseMemoryLog(gitMemoryLog(root, limit));
+    if (opts.json) {
+        console.log(JSON.stringify(moves));
+        return;
+    }
+    if (!moves.length) {
+        console.log("No memory moves yet — nothing has changed .hunch/.");
+        return;
+    }
+    const icon = { capture: "✚", adopt: "✓", supersede: "↻", prune: "✗", repair: "🔧", edit: "•" };
+    for (const m of moves) {
+        const ids = [...m.decisionIds, ...m.otherIds].slice(0, 4).join(",");
+        console.log(`${m.date.slice(0, 10)}  ${icon[m.kind]} ${m.kind.padEnd(9)} ${m.shortSha}  ${m.subject.slice(0, 60)}${ids ? "  " + dim(ids) : ""}`);
+    }
+});
+/** Self-repair (Phase 5): heal exact-path memory bindings after a commit's renames.
+ *  Returns the plan (null when the commit renamed nothing that memory binds).
+ *  Apply mode rewrites the records in their homes, reindexes, and auto-commits each
+ *  touched home as a `repair` move on the timeline — background, revertable. */
+function runRepair(store, root, sha, apply) {
+    const renames = renamesOf(commitChanges(sha, root));
+    if (!renames.length)
+        return null;
+    const plan = planRepair(renames, store.recs("decisions"), store.recs("constraints"));
+    // Policy bindings heal under the same zero-guessing contract; a broken policy
+    // store must never take graph-record repair down (fail open).
+    let service = null;
+    let policyRewrites = [];
+    try {
+        service = new ConstitutionService(store, root);
+        policyRewrites = planPolicyRepair(renames, service.list());
+    }
+    catch {
+        service = null;
+    }
+    if (!plan.rewrites.length && !policyRewrites.length)
+        return null;
+    if (!apply)
+        return { plan, policyRewrites, applied: false };
+    let privateTouched = false, publicTouched = false;
+    for (const d of store.recs("decisions")) {
+        const healed = repairDecision(d, plan);
+        if (healed === d)
+            continue;
+        store.putWhereItLives("decisions", healed);
+        if (store.getPrivateRec("decisions", d.id))
+            privateTouched = true;
+        else
+            publicTouched = true;
+    }
+    for (const c of store.recs("constraints")) {
+        const healed = repairConstraint(c, plan);
+        if (healed === c)
+            continue;
+        store.putWhereItLives("constraints", healed);
+        if (store.getPrivateRec("constraints", c.id))
+            privateTouched = true;
+        else
+            publicTouched = true;
+    }
+    if (service && policyRewrites.length) {
+        const at = new Date().toISOString();
+        for (const p of service.list()) {
+            const healed = repairPolicySpec(p, policyRewrites, at);
+            if (healed === p)
+                continue;
+            service.repository.putPolicy(healed);
+            if (healed.data_class === "public")
+                publicTouched = true;
+            else
+                privateTouched = true;
+        }
+    }
+    store.reindex();
+    if (store.autoCommit) {
+        const total = plan.rewrites.length + policyRewrites.length;
+        const message = `hunch: repair ${total} binding(s) after rename (${sha.slice(0, 7)})`;
+        if (publicTouched)
+            commitAndPushHunch(hunchPaths(root).hunch, message, { push: false });
+        if (privateTouched && store.privateDir)
+            commitAndPushHunch(store.privateDir, message, { push: true });
+    }
+    return { plan, policyRewrites, applied: true };
+}
+program
+    .command("repair")
+    .description("Self-repair: heal memory bindings (decision files, tripwire/constraint scopes) after a commit's renames — git's own rename detection, exact-path matches only, zero guessing. Dry-run unless --apply; the sync hook applies this automatically in the background.")
+    .argument("[sha]", "commit whose renames to heal (default: HEAD)")
+    .option("--apply", "rewrite the bindings (auto-commits each touched store as a `repair` move)")
+    .action((sha, opts) => {
+    const { store, root } = storeFor();
+    try {
+        if (!isGitRepo(root))
+            return fail("repair needs a git repo.");
+        const res = runRepair(store, root, sha ?? headSha(root), !!opts.apply);
+        if (!res) {
+            console.log("✓ Nothing to repair — the commit renamed nothing that memory binds exactly.");
+            return;
+        }
+        const total = res.plan.rewrites.length + res.policyRewrites.length;
+        console.log(`${res.applied ? "✓ Repaired" : "Would repair"} ${total} binding(s):`);
+        for (const r of res.plan.rewrites)
+            console.log(`  ${r.id}  ${r.field}: ${r.from} → ${r.to}`);
+        for (const r of res.policyRewrites)
+            console.log(`  ${r.id}  ${r.field}: ${r.from} → ${r.to}`);
+        if (res.policyRewrites.length && res.applied)
+            console.log(dim("\nRepaired policies need a fresh proof — they ask via `hunch escalations`."));
+        if (!res.applied)
+            console.log(dim("\nDry run — nothing changed. Re-run with --apply."));
+    }
+    finally {
+        store.close();
+    }
+});
+program
+    .command("revert-move <sha>")
+    .description("Undo one memory move: git-revert the commit that made it (LOCAL only, never pushed). Powers the Hunch view's 'reject move'.")
+    .action((sha) => {
+    const root = findRoot();
+    if (!isGitRepo(root))
+        return fail("not a git repo.");
+    if (!revertMemoryMove(sha, root))
+        return fail(`could not revert ${sha} (conflict or unknown commit) — aborted; working tree unchanged.`);
+    console.log(`✓ reverted memory move ${sha} (local; not pushed).`);
+});
+program
+    .command("push")
+    .description("The approve-to-push step: push the current branch to its remote. Auto-commit keeps memory LOCAL by design; this is the one explicit outward move (public .hunch/ rides the repo, so this is a plain branch push).")
+    .action(() => {
+    const root = findRoot();
+    if (!isGitRepo(root))
+        return fail("not a git repo.");
+    if (!pushCurrentBranch(root))
+        return fail("push failed — no upstream, offline, or nothing to push.");
+    console.log("✓ pushed the current branch to its remote.");
+});
 // ---- drift (doc≠graph detector; advisory + CI-gateable) -------------------
 program
     .command("drift")
@@ -3563,7 +3907,7 @@ program
         for (const r of roadmap)
             console.log(`  • ${r.title}  (${r.id}${r.topic ? `, ${r.topic}` : ""}, since ${r.date})\n      ${r.note}`);
         if (pendingReview > 0)
-            console.log(`\n  (${pendingReview} auto-drafted proposal(s) awaiting review — \`hunch review\`)`);
+            console.log(`\n  (${pendingReview} legacy un-vouched draft(s) — \`hunch adopt-drafts\` to auto-trust them as advisory)`);
     }
     finally {
         store.close();

package/dist/constitution/experiment.js

@@ -349,7 +349,10 @@ const Exp01MetricsSchema = z.object({
         ctx.addIssue({ code: "custom", path: ["policy_violation"], message: "policy_violation must be present exactly for valid completions" });
 });
 const Exp03MetricsSchema = z.object({
-    decision: z.enum(["accepted_precise", "accepted_edited", "rejected", "uncompilable", "abandoned", "timeout"]),
+    // "uncompilable" is the revision-1 vocabulary; "cannot_decide" is its revision-2
+    // successor (expreg_ba6aef4ecd counts cannot-decide as its own raw category, so
+    // the recorded token must be what the reviewer actually chose — never folded).
+    decision: z.enum(["accepted_precise", "accepted_edited", "rejected", "uncompilable", "cannot_decide", "abandoned", "timeout"]),
     precise: z.boolean(),
     proof_inspected: z.boolean(),
     result_hash: z.string().regex(HASH).nullable(),
@@ -452,6 +455,58 @@ export function compileExperimentOutcome(input, run, opts = {}) {
     }
     return parsed;
 }
+// ---- EXP-03 revision-2 standardized response (dec_0be4fd3717) --------------
+// Revision-2 reviews are SUBMITTED in the same plain-language vocabulary they are
+// PRESENTED in: one choice out of four, the rule text when one is kept, and one
+// plain sentence. The mapper below is the single deterministic translation from
+// that template into the canonical Exp03 metrics vocabulary — the reviewer never
+// hand-crafts metrics, so the presented contract and the recorded outcome cannot
+// drift apart. Revision-1 cases are refused here (their original raw submission
+// path stays byte-identical for the append-only pilot).
+export const EXP03_REVIEW_CHOICES = ["accept", "edit", "reject", "cannot_decide"];
+const CHOICE_TO_DECISION = {
+    accept: "accepted_precise",
+    edit: "accepted_edited",
+    reject: "rejected",
+    cannot_decide: "cannot_decide", // its own raw category per expreg_ba6aef4ecd — never folded into uncompilable
+};
+export function compileExp03ReviewResponse(item, arm, response) {
+    if (!item.required_relationship) {
+        throw new Error(`case ${item.id} is a revision-1 pilot case and keeps its original submission contract; use the raw review submission, not the standardized template`);
+    }
+    if (!EXP03_REVIEW_CHOICES.includes(response.choice)) {
+        throw new Error(`choice must be one of: ${EXP03_REVIEW_CHOICES.join(" | ")}`);
+    }
+    const reason = response.reason?.trim();
+    if (!reason)
+        throw new Error("the response requires one plain-language sentence of reasoning");
+    const accepted = response.choice === "accept" || response.choice === "edit";
+    const rule = response.rule_text?.trim() || null;
+    if (accepted && !rule)
+        throw new Error(`choice "${response.choice}" requires the rule text it keeps`);
+    if (!accepted && rule)
+        throw new Error(`choice "${response.choice}" must leave the rule text blank`);
+    // Arms B/C present a proposed rule: "use it as written" must be byte-faithful to
+    // what was shown, and "after I correct it" must actually change it — the choice
+    // and the submitted text can never contradict each other.
+    if (arm !== "A" && response.choice === "accept" && rule !== item.compiler_candidate) {
+        throw new Error('the submitted rule differs from the one presented; use choice "edit"');
+    }
+    if (arm !== "A" && response.choice === "edit" && rule === item.compiler_candidate) {
+        throw new Error('the submitted rule is unchanged from the one presented; use choice "accept"');
+    }
+    if (response.inspected_supporting_checks && arm !== "C") {
+        throw new Error("supporting checks are only shown in arm C; this review cannot claim to have inspected them");
+    }
+    return {
+        decision: CHOICE_TO_DECISION[response.choice],
+        precise: accepted, // schema invariant: accepted outcomes are precise; graded later against the target commitment
+        proof_inspected: arm === "C" && !!response.inspected_supporting_checks,
+        result: accepted ? rule : null,
+        silent_semantic_substitution: false, // graded post-hoc via the append-only correction workflow, never self-declared
+        rejection_reason: response.choice === "reject" ? reason : null,
+    };
+}
 export const ExperimentReviewStartSchema = z.object({
     id: z.string().regex(/^expreview_[a-f0-9]{10}$/),
     content_hash: z.string().regex(HASH),
@@ -564,6 +619,7 @@ export function compileExperimentStop(input, run, opts = {}) {
     const contentHash = canonicalHash(body);
     return ExperimentStopSchema.parse({ id: `expstop_${shortHash(contentHash)}`, content_hash: contentHash, ...body });
 }
+const EXP03_DECISION_TOKENS = ["accepted_precise", "accepted_edited", "rejected", "uncompilable", "cannot_decide", "abandoned", "timeout"];
 function wilson(successes, total) {
     if (!total)
         return null;
@@ -668,6 +724,9 @@ export function buildExperimentReport(run, bank, outcomes, followups, stops = []
             bootstrap_95: run.experiment === "EXP-03" ? bootstrapReviewerRate(reviews, `${run.seed}:${arm}:reviewer-rate`) : null,
             reversals: run.experiment === "EXP-03" ? measuredFollowups.filter((item) => item.reversed === true).length : null,
             followups_missing: run.experiment === "EXP-03" ? completed.length - measuredFollowups.length : null,
+            decisions: run.experiment === "EXP-03"
+                ? Object.fromEntries(EXP03_DECISION_TOKENS.map((token) => [token, reviews.filter((item) => item.decision === token).length]))
+                : null,
         };
     });
     const caseById = new Map(bank.cases.map((item) => [item.id, item]));