@hivelore/cli 0.34.1 → 0.35.0

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   preCommitCheck,
   readPresumedCorrectTargets,
   runHaiveMcpStdio
-} from "./chunk-X6UHROFL.js";
+} from "./chunk-ZR7UPTRR.js";
 import {
   registerMemoryPending
 } from "./chunk-OYJKHD22.js";
@@ -275,7 +275,7 @@ async function lintMemoriesAsync(root, options = {}) {
   const loaded = await loadMemoriesFromDir2(paths.memoriesDir);
   const usage = await loadUsageIndex(paths);
   const codeMap = await loadCodeMap(paths);
-  const trackedFiles = gitTrackedFiles(root);
+  const trackedFiles2 = gitTrackedFiles(root);
   const ANCHOR_TYPES = /* @__PURE__ */ new Set(["decision", "architecture", "gotcha"]);
   const actionableWords = /\b(always|never|prefer|use|run|avoid|because|instead|why|rationale|do not|must|should|require|required|requires|fix|fail|failed|fails|prevent|prevents|allow|allows|lets|ensure|ensures|catch|catches)\b/i;
   for (const { filePath, memory: memory2 } of loaded) {
@@ -323,7 +323,7 @@ async function lintMemoriesAsync(root, options = {}) {
       });
     }
     const isStackSeed = fm.tags.includes("stack-pack");
-    const suggestedAnchors = isStackSeed ? { paths: [], symbols: [] } : suggestAnchors(root, { filePath, memory: memory2 }, codeMap, trackedFiles);
+    const suggestedAnchors = isStackSeed ? { paths: [], symbols: [] } : suggestAnchors(root, { filePath, memory: memory2 }, codeMap, trackedFiles2);
     if (ANCHOR_TYPES.has(fm.type) && fm.anchor.paths.length === 0 && fm.status === "validated" && !isStackSeed) {
       out.push({
         file: filePath,
@@ -435,14 +435,14 @@ function titleFromId(id) {
   const withoutDate = id.replace(/^\d{4}-\d{2}-\d{2}-/, "");
   return withoutDate.split("-").filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join(" ");
 }
-function suggestAnchors(root, loaded, codeMap, trackedFiles) {
+function suggestAnchors(root, loaded, codeMap, trackedFiles2) {
   const body = loaded.memory.body;
   const paths = /* @__PURE__ */ new Set();
   const symbols = /* @__PURE__ */ new Set();
   for (const match of body.matchAll(/`([^`\n]+\.[A-Za-z0-9]+)`|(?:^|\s)([A-Za-z0-9_./-]+\.[A-Za-z0-9]+)/gm)) {
     const candidate = (match[1] ?? match[2] ?? "").replace(/^\.?\//, "");
     if (!candidate || candidate.startsWith("http")) continue;
-    if (existsSync(path2.join(root, candidate)) && isSafeAnchorPath(candidate, trackedFiles)) {
+    if (existsSync(path2.join(root, candidate)) && isSafeAnchorPath(candidate, trackedFiles2)) {
       paths.add(candidate);
     }
   }
@@ -452,7 +452,7 @@ function suggestAnchors(root, loaded, codeMap, trackedFiles) {
       for (const exp of entry.exports) {
         if (!exp.name || exp.name.length < 4) continue;
         if (lowered.includes(exp.name.toLowerCase())) {
-          if (isSafeAnchorPath(file, trackedFiles)) {
+          if (isSafeAnchorPath(file, trackedFiles2)) {
             paths.add(file);
             symbols.add(exp.name);
           }
@@ -477,12 +477,12 @@ function gitTrackedFiles(root) {
   const files = result.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
   return new Set(files);
 }
-function isSafeAnchorPath(file, trackedFiles) {
+function isSafeAnchorPath(file, trackedFiles2) {
   const normalized = file.replace(/\\/g, "/").replace(/^\.?\//, "");
   if (normalized.startsWith(".ai/.cache/") || normalized.startsWith(".ai/.runtime/")) return false;
   if (normalized.includes("/node_modules/") || normalized.startsWith("node_modules/")) return false;
   if (normalized.includes("/dist/") || normalized.startsWith("dist/")) return false;
-  if (trackedFiles && !trackedFiles.has(normalized)) return false;
+  if (trackedFiles2 && !trackedFiles2.has(normalized)) return false;
   return true;
 }
 function nearDuplicatePairs(loaded) {
@@ -3755,7 +3755,7 @@ ${SEED_FOOTER(stack)}` });
 
 // src/commands/init.ts
 var execFileAsync = promisify2(execFile2);
-var HAIVE_GITHUB_ACTION_REF = `v${"0.34.1"}`;
+var HAIVE_GITHUB_ACTION_REF = `v${"0.35.0"}`;
 var PROJECT_CONTEXT_TEMPLATE = `# Project context
 
 > Generated by \`hivelore init\`. Run \`hivelore init --bootstrap\` to auto-fill from your codebase,
@@ -4714,20 +4714,27 @@ import path15 from "path";
 import "commander";
 import {
   DEFAULT_AUTO_PROMOTE_RULE,
+  assessSensorHealth,
   buildFrontmatter as buildFrontmatter3,
+  existingGateMissShas,
   findProjectRoot as findProjectRoot9,
   getUsage as getUsage2,
+  gatePassedShas,
   isAutoPromoteEligible,
   isDecaying,
   isStackPackSeed,
   loadCodeMap as loadCodeMap5,
   loadConfig as loadConfig3,
   loadMemoriesFromDir as loadMemoriesFromDir7,
+  loadSensorLedger,
   loadUsageIndex as loadUsageIndex3,
   pullCrossRepoSources,
+  planGitWatch,
+  proposeGateMissDrafts,
   resolveHaivePaths as resolveHaivePaths8,
   resolveManifestFiles,
   serializeMemory as serializeMemory4,
+  withQuarantineNote,
   trackDependencies,
   verifyAnchor,
   watchContracts
@@ -4765,6 +4772,24 @@ function registerSync(program2) {
     let revalidated = 0;
     let promoted = 0;
     let autoApproved = 0;
+    let quarantined = 0;
+    const sensorHealth = new Map(
+      assessSensorHealth(await loadSensorLedger(paths)).map((health) => [health.memory_id, health])
+    );
+    const quarantineCandidates = await loadMemoriesFromDir7(paths.memoriesDir);
+    for (const { memory: memory2, filePath } of quarantineCandidates) {
+      const sensor = memory2.frontmatter.sensor;
+      const health = sensorHealth.get(memory2.frontmatter.id);
+      if (!sensor || sensor.kind !== "shell" && sensor.kind !== "test" || sensor.severity !== "block" || !health?.quarantine_pending) continue;
+      if (!dryRun) {
+        const at = (/* @__PURE__ */ new Date()).toISOString();
+        await writeFile8(filePath, serializeMemory4({
+          frontmatter: { ...memory2.frontmatter, sensor: { ...sensor, severity: "warn" } },
+          body: withQuarantineNote(memory2.body, at, health.flap_count)
+        }), "utf8");
+      }
+      quarantined++;
+    }
     if (opts.verify !== false) {
       const memories = await loadMemoriesFromDir7(paths.memoriesDir);
       for (const { memory: memory2, filePath } of memories) {
@@ -4885,13 +4910,17 @@ function registerSync(program2) {
       for (const repair of repairs) log(ui.dim(`autopilot: ${repair.message}`));
     }
     const sinceReport = opts.since ? collectSinceChanges(root, opts.since) : null;
+    const gateMissIds = await processGateMissWatch(root, paths, dryRun);
+    if (gateMissIds.length > 0) {
+      log(ui.yellow(`gate-miss: proposed ${gateMissIds.length} lesson(s): ${gateMissIds.join(", ")}`));
+    }
     const draftMemories = (await loadMemoriesFromDir7(paths.memoriesDir)).filter(
       (m) => m.memory.frontmatter.status === "draft"
     );
     const draftCount = draftMemories.length;
     const autoApprovedNote = autoApproved > 0 ? ` \xB7 ${autoApproved} auto-approved` : "";
     log(
-      `${ui.dim("sync:")} ${staleMarked} stale \xB7 ${revalidated} revalidated \xB7 ${promoted} promoted${autoApprovedNote}${sinceReport ? ` \xB7 ${sinceReport.added.length}+/${sinceReport.modified.length}~/${sinceReport.removed.length}- since ${opts.since}` : ""}`
+      `${ui.dim("sync:")} ${staleMarked} stale \xB7 ${revalidated} revalidated \xB7 ${promoted} promoted \xB7 ${quarantined} quarantined${autoApprovedNote}${sinceReport ? ` \xB7 ${sinceReport.added.length}+/${sinceReport.modified.length}~/${sinceReport.removed.length}- since ${opts.since}` : ""}`
     );
     if (!opts.quiet && draftCount > 0) {
       log(
@@ -5209,6 +5238,83 @@ Wait for **explicit confirmation** before acting.
     }
   });
 }
+async function processGateMissWatch(root, paths, dryRun) {
+  const headResult = spawnSync4("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" });
+  if (headResult.status !== 0) return [];
+  const head = headResult.stdout.trim();
+  if (!head) return [];
+  const stateFile = path15.join(paths.runtimeDir, "enforcement", "git-watch.json");
+  let state = null;
+  try {
+    state = JSON.parse(await readFile7(stateFile, "utf8"));
+  } catch {
+  }
+  const plan = planGitWatch(state, head);
+  if (plan.action === "initialize") {
+    if (!dryRun) {
+      await mkdir8(path15.dirname(stateFile), { recursive: true });
+      await writeFile8(stateFile, JSON.stringify(plan.next, null, 2) + "\n", "utf8");
+    }
+    return [];
+  }
+  if (plan.action === "idle") return [];
+  const proposals = proposeGateMissDrafts(
+    readGitCommitsRange(root, plan.range),
+    existingGateMissShas(await loadMemoriesFromDir7(paths.memoriesDir)),
+    gatePassedShas(await loadSensorLedger(paths))
+  );
+  const ids = [];
+  for (const proposal of proposals) {
+    const fm = {
+      ...buildFrontmatter3({
+        type: "attempt",
+        slug: proposal.slug,
+        scope: "team",
+        status: "proposed",
+        tags: ["gate-miss", proposal.kind],
+        paths: proposal.paths,
+        topic: `gate-miss-${proposal.reverted_sha}`
+      }),
+      status: "proposed"
+    };
+    ids.push(fm.id);
+    if (!dryRun) {
+      await mkdir8(paths.teamDir, { recursive: true });
+      await writeFile8(
+        path15.join(paths.teamDir, `${fm.id}.md`),
+        serializeMemory4({ frontmatter: fm, body: proposal.body }),
+        "utf8"
+      );
+    }
+  }
+  if (!dryRun) {
+    await mkdir8(path15.dirname(stateFile), { recursive: true });
+    await writeFile8(stateFile, JSON.stringify(plan.next, null, 2) + "\n", "utf8");
+  }
+  return ids;
+}
+function readGitCommitsRange(root, range) {
+  const result = spawnSync4(
+    "git",
+    ["log", "--reverse", "--format=%x1e%H%x1f%s%x1f%b%x1f", "--name-only", range],
+    { cwd: root, encoding: "utf8", maxBuffer: 8 * 1024 * 1024 }
+  );
+  if (result.status !== 0) return [];
+  const commits = [];
+  for (const block of result.stdout.split("").filter((part) => part.trim())) {
+    const [shaRaw, subjectRaw, bodyRaw, filesRaw = ""] = block.split("");
+    const sha = shaRaw?.trim();
+    const subject = subjectRaw?.trim();
+    if (!sha || !subject) continue;
+    commits.push({
+      sha,
+      subject,
+      body: bodyRaw?.trim() ?? "",
+      files: filesRaw.split("\n").map((file) => file.trim()).filter(Boolean)
+    });
+  }
+  return commits;
+}
 function bridgeSummaryLine(body) {
   const firstLine = body.split("\n").map((l) => l.replace(/^#+\s*/, "").trim()).find((l) => l.length > 0) ?? "";
   const oneLine = firstLine.replace(/\s+/g, " ");
@@ -7207,16 +7313,34 @@ import { mkdir as mkdir12, writeFile as writeFile18 } from "fs/promises";
 import path30 from "path";
 import {
   aggregateUsage,
+  buildPreventionReceipt,
+  renderPreventionReceipt,
   findProjectRoot as findProjectRoot28,
   loadMemoriesFromDir as loadMemoriesFromDir11,
   loadUsageIndex as loadUsageIndex12,
+  loadPreventionEvents as loadPreventionEvents2,
   parseSince,
   readUsageEvents,
   resolveHaivePaths as resolveHaivePaths27,
   usageLogSize
 } from "@hivelore/core";
 function registerStats(program2) {
-  program2.command("stats").description("Show MCP tool-usage stats over a window (e.g. --since 7d).").option("--since <window>", "ISO date or relative (e.g. '7d', '24h', '30m')", "30d").option("--json", "emit JSON instead of human-readable output", false).option("--memory-hits", "show top-read memories (which mems are actually being used)", false).option(
+  const stats = program2.command("stats").description("Show MCP tool-usage stats and prevention receipts.");
+  stats.command("receipt").description("Show documented mistakes refused by the gate over a time window").addHelpText("after", "\nParent options also apply: --since <window> (default 7d here), --json, --dir <dir>.").action(async () => {
+    const opts = stats.opts();
+    const root = findProjectRoot28(opts.dir);
+    const paths = resolveHaivePaths27(root);
+    const sinceRaw = stats.getOptionValueSource("since") === "default" ? "7d" : opts.since ?? "7d";
+    const since = parseSince(sinceRaw) ?? new Date(Date.now() - 7 * 864e5);
+    const [events, usage, memories] = await Promise.all([
+      loadPreventionEvents2(paths),
+      loadUsageIndex12(paths),
+      existsSync33(paths.memoriesDir) ? loadMemoriesFromDir11(paths.memoriesDir) : Promise.resolve([])
+    ]);
+    const receipt = buildPreventionReceipt(events, memories, usage, { since });
+    console.log(opts.json ? JSON.stringify(receipt, null, 2) : renderPreventionReceipt(receipt));
+  });
+  stats.option("--since <window>", "ISO date or relative (e.g. '7d', '24h', '30m')", "30d").option("--json", "emit JSON instead of human-readable output", false).option("--memory-hits", "show top-read memories (which mems are actually being used)", false).option(
     "--export-report <path>",
     "write a JSON rollup (tools + briefing counts + heuristic ROI hints). Parent dirs are created if needed.",
     void 0
@@ -7662,7 +7786,7 @@ import {
   findProjectRoot as findProjectRoot31,
   loadConfig as loadConfig7,
   loadEvalHistory,
-  loadPreventionEvents as loadPreventionEvents2,
+  loadPreventionEvents as loadPreventionEvents3,
   loadUsageIndex as loadUsageIndex13,
   overallScore,
   resolveHaivePaths as resolveHaivePaths29,
@@ -7729,7 +7853,7 @@ function registerEval(program2) {
     const authoredScore = resolvedSpec.authored > 0 && resolvedSpec.synthesized > 0 && (authoredRetrievalAgg || sensorAgg) ? overallScore(authoredRetrievalAgg, sensorAgg) : null;
     const [usage, preventionEvents, config] = await Promise.all([
       loadUsageIndex13(paths),
-      loadPreventionEvents2(paths),
+      loadPreventionEvents3(paths),
       loadConfig7(paths)
     ]);
     const gatePrecision = computeGatePrecision(
@@ -8449,6 +8573,7 @@ import { execFileSync, execSync } from "child_process";
 import "commander";
 import {
   codeMapPath as codeMapPath2,
+  assessSensorHealth as assessSensorHealth2,
   countSourceFilesOnDisk,
   extractReferencedPaths,
   sensorPatternBrittleness,
@@ -8459,6 +8584,7 @@ import {
   loadCodeMap as loadCodeMap6,
   loadConfig as loadConfig10,
   loadMemoriesFromDirDetailed,
+  loadSensorLedger as loadSensorLedger2,
   loadUsageIndex as loadUsageIndex15,
   readUsageEvents as readUsageEvents3,
   resolveHaivePaths as resolveHaivePaths33
@@ -8654,6 +8780,18 @@ function registerDoctor(program2) {
       });
     }
     const sensorMemories = memories.filter((m) => m.memory.frontmatter.sensor);
+    const gateMissDrafts = memories.filter(
+      (m) => m.memory.frontmatter.status === "proposed" && m.memory.frontmatter.tags.includes("gate-miss")
+    );
+    if (gateMissDrafts.length > 0) {
+      findings.push({
+        severity: "info",
+        code: "gate-miss-drafts",
+        section: "Corpus health",
+        message: `${gateMissDrafts.length} proposed gate-miss lesson(s) await review: ${gateMissDrafts.slice(0, 5).map((m) => m.memory.frontmatter.id).join(", ")}.`,
+        fix: "Review with `hivelore memory list --status proposed`."
+      });
+    }
     const blockSensors = sensorMemories.filter(
       (m) => m.memory.frontmatter.sensor?.severity === "block"
     ).length;
@@ -8694,6 +8832,26 @@ function registerDoctor(program2) {
         fix: "Make the pattern discriminating (add an 'absent' companion), or demote: `hivelore sensors promote <id> --severity warn`"
       });
     }
+    const sensorHealth = assessSensorHealth2(await loadSensorLedger2(paths));
+    for (const health of sensorHealth.filter((h) => h.quarantine_pending)) {
+      const last = health.flaps.at(-1);
+      findings.push({
+        severity: "warn",
+        code: "sensor-flaky",
+        section: "Protection",
+        message: `${health.memory_id} flapped ${health.flap_count}\xD7 on identical inputs. Last contradiction: ${last.previous.at} ${last.previous.outcome} \u2192 ${last.current.at} ${last.current.outcome}.`,
+        fix: "Run `hivelore sync` to demote it, fix the oracle, then `hivelore sensors promote <id> --yes`."
+      });
+    }
+    for (const health of sensorHealth.filter((h) => h.never_fired)) {
+      findings.push({
+        severity: "info",
+        code: "sensor-never-fired",
+        section: "Protection",
+        message: `${health.memory_id} was evaluated ${health.evaluation_count} times across 30+ days and never fired \u2014 retirement candidate.`,
+        fix: "Review the sensor manually; no automatic delete/retire command is provided."
+      });
+    }
     const codeMap = await loadCodeMap6(paths);
     if (!codeMap) {
       findings.push({
@@ -8791,7 +8949,7 @@ function registerDoctor(program2) {
         fix: "Edit .ai/haive.config.json: set autoSessionEnd: true (or re-run `hivelore init` without --manual)."
       });
     }
-    findings.push(...await collectInstallFindings(root, "0.34.1"));
+    findings.push(...await collectInstallFindings(root, "0.35.0"));
     findings.push(...await collectToolchainFindings(root));
     try {
       const legacyRaw = execSync("haive-mcp --version", {
@@ -8799,7 +8957,7 @@ function registerDoctor(program2) {
         timeout: 3e3,
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
-      const cliVersion = "0.34.1";
+      const cliVersion = "0.35.0";
       if (legacyRaw && legacyRaw !== cliVersion) {
         findings.push({
           severity: "warn",
@@ -9529,14 +9687,16 @@ function registerResolveProject(program2) {
 }
 
 // src/commands/enforce.ts
-import { execFile as execFile4, execFileSync as execFileSync2, spawn as spawn4 } from "child_process";
+import { execFile as execFile5, execFileSync as execFileSync2, spawn as spawn4 } from "child_process";
 import { existsSync as existsSync41, statSync as statSync3 } from "fs";
 import { chmod, mkdir as mkdir16, readFile as readFile18, readdir as readdir4, rm as rm2, writeFile as writeFile25 } from "fs/promises";
 import path39 from "path";
-import { promisify as promisify4 } from "util";
+import { promisify as promisify5 } from "util";
 import "commander";
 import {
   antiPatternGateParams as antiPatternGateParams2,
+  appendSensorEvaluations,
+  assessSensorHealth as assessSensorHealth3,
   assessBootstrapState,
   isSensorScannablePath,
   findProjectRoot as findProjectRoot37,
@@ -9550,6 +9710,7 @@ import {
   loadConfig as loadConfig12,
   detectAgentContext,
   loadMemoriesFromDir as loadMemoriesFromDir14,
+  loadSensorLedger as loadSensorLedger3,
   memoryMatchesAnchorPaths as memoryMatchesAnchorPaths2,
   readRecentBriefingMarker,
   recordPreventionHits,
@@ -9559,6 +9720,7 @@ import {
   saveConfig as saveConfig3,
   selectCommandSensors,
   sensorTargetsFromDiff,
+  sensorAppliesToPath as sensorAppliesToPath2,
   SESSION_RECAP_TTL_MS,
   verifyAnchor as verifyAnchor3,
   writeBriefingMarker as writeBriefingMarker2
@@ -9761,8 +9923,52 @@ async function executeCommandSensors(specs, root) {
   return runs;
 }
 
+// src/utils/sensor-evaluations.ts
+import { execFile as execFile4 } from "child_process";
+import { promisify as promisify4 } from "util";
+import {
+  computeScopeHash,
+  sensorAppliesToPath
+} from "@hivelore/core";
+var exec3 = promisify4(execFile4);
+async function gitHeadSha(root) {
+  try {
+    const { stdout } = await exec3("git", ["rev-parse", "HEAD"], { cwd: root });
+    return stdout.trim();
+  } catch {
+    return "";
+  }
+}
+async function trackedFiles(root) {
+  try {
+    const { stdout } = await exec3("git", ["ls-files", "-co", "--exclude-standard"], { cwd: root });
+    return stdout.split("\n").map((f) => f.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+async function commandScopeHash(root, spec) {
+  if (spec.paths.length === 0) return "";
+  const sensor = { kind: spec.kind, paths: spec.paths };
+  const files = (await trackedFiles(root)).filter((file) => sensorAppliesToPath(sensor, [], file));
+  return computeScopeHash(root, files);
+}
+function evaluation(base, command) {
+  return {
+    at: base.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+    memory_id: base.memory_id,
+    kind: base.kind,
+    stage: base.stage,
+    head_sha: base.head_sha,
+    scope_hash: base.scope_hash,
+    outcome: base.outcome,
+    ...command?.exit_code !== null ? { exit_code: command?.exit_code } : {},
+    ...command ? { duration_ms: command.duration_ms } : {}
+  };
+}
+
 // src/commands/enforce.ts
-var execFileAsync2 = promisify4(execFile4);
+var execFileAsync2 = promisify5(execFile5);
 var MAX_STDIN_BYTES2 = 256 * 1024;
 var ENFORCE_HOOK_MARKER = "# Hivelore enforcement hook";
 function registerEnforce(program2) {
@@ -10451,7 +10657,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
       findings: [{ severity: "info", code: "enforcement-off", message: "Hivelore enforcement is disabled." }]
     });
   }
-  findings.push(...await inspectIntegrationVersions(root, "0.34.1"));
+  findings.push(...await inspectIntegrationVersions(root, "0.35.0"));
   if (config.enforcement?.requireBriefingFirst !== false && stage !== "ci") {
     const hasBriefing = await hasRecentBriefingMarker(paths, sessionId);
     findings.push(hasBriefing ? { severity: "ok", code: "briefing-loaded", message: "A recent Hivelore briefing marker exists." } : {
@@ -10531,7 +10737,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
     }];
   }
   const hasErrors = effectiveFindings.some((f) => f.severity === "error");
-  return withCategories({
+  const report = withCategories({
     root,
     initialized,
     mode,
@@ -10540,6 +10746,18 @@ async function buildEnforcementReport(dir, stage, sessionId) {
     should_block: mode === "strict" && hasErrors,
     findings: effectiveFindings
   });
+  if (!report.should_block && (stage === "pre-commit" || stage === "ci")) {
+    const headSha = await gitHeadSha(root);
+    await appendSensorEvaluations(paths, [evaluation({
+      memory_id: "__gate__",
+      kind: "shell",
+      stage,
+      head_sha: headSha,
+      scope_hash: "",
+      outcome: "silent"
+    })]);
+  }
+  return report;
 }
 function withCategories(report) {
   return {
@@ -10695,7 +10913,7 @@ async function runPrecommitPolicy(paths, gate, stage) {
     anchored_blocks,
     semantic: true
   }, { paths });
-  const sensorFindings = await runSensorGate(paths, snapshot.diff);
+  const sensorFindings = await runSensorGate(paths, snapshot.diff, stage);
   const reviewWarnings = result.warnings.filter(
     (w) => w.level === "review" && !w.reasons.includes("sensor")
   );
@@ -10758,7 +10976,7 @@ async function runPrecommitPolicy(paths, gate, stage) {
     ...sensorFindings
   ];
 }
-async function runSensorGate(paths, diff) {
+async function runSensorGate(paths, diff, stage) {
   if (!diff || !existsSync41(paths.memoriesDir)) return [];
   try {
     const loaded = await loadMemoriesFromDir14(paths.memoriesDir);
@@ -10769,8 +10987,22 @@ async function runSensorGate(paths, diff) {
     const findings = [];
     const seen = /* @__PURE__ */ new Set();
     const firedIds = /* @__PURE__ */ new Set();
+    const ledgerRows = [];
+    const headSha = await gitHeadSha(paths.root);
     const regexSensorMemories = scannable.filter((m) => m.frontmatter.sensor.kind === "regex");
     const hits = regexSensorMemories.length > 0 ? runSensors(regexSensorMemories, targets) : [];
+    for (const memory2 of regexSensorMemories) {
+      const sensor = memory2.frontmatter.sensor;
+      if (!targets.some((target) => sensorAppliesToPath2(sensor, memory2.frontmatter.anchor.paths, target.path))) continue;
+      ledgerRows.push(evaluation({
+        memory_id: memory2.frontmatter.id,
+        kind: "regex",
+        stage,
+        head_sha: headSha,
+        scope_hash: "",
+        outcome: hits.some((hit) => hit.memory_id === memory2.frontmatter.id) ? "fired" : "silent"
+      }));
+    }
     for (const hit of hits) {
       if (seen.has(hit.memory_id)) continue;
       seen.add(hit.memory_id);
@@ -10782,7 +11014,8 @@ async function runSensorGate(paths, diff) {
           code: "sensor-block",
           message: `Block sensor fired \u2014 ${hit.memory_id}: ${hit.message}${where}`,
           fix: "Remove the flagged pattern, or run `hivelore sensors check` to inspect the match.",
-          impact: 45
+          impact: 45,
+          memory_ids: [hit.memory_id]
         });
       } else {
         findings.push({
@@ -10790,7 +11023,8 @@ async function runSensorGate(paths, diff) {
           code: "sensor-warn",
           message: `Sensor flagged ${hit.memory_id}: ${hit.message}${where}`,
           fix: "Review the flagged line; `hivelore sensors check` shows the matched code.",
-          impact: 5
+          impact: 5,
+          memory_ids: [hit.memory_id]
         });
       }
     }
@@ -10798,7 +11032,34 @@ async function runSensorGate(paths, diff) {
     if (config?.enforcement?.runCommandSensors === true) {
       const changedPaths = targets.map((t) => t.path).filter(Boolean);
       const specs = selectCommandSensors(scannable, changedPaths).filter((sp) => !seen.has(sp.memory_id));
-      for (const run of await executeCommandSensors(specs, paths.root)) {
+      const runs = await executeCommandSensors(specs, paths.root);
+      for (const run of runs) {
+        const spec = specs.find((candidate) => candidate.memory_id === run.memory_id);
+        ledgerRows.push(evaluation({
+          memory_id: run.memory_id,
+          kind: run.kind,
+          stage,
+          head_sha: headSha,
+          scope_hash: await commandScopeHash(paths.root, spec),
+          outcome: run.status === "failed" ? "fired" : run.status === "passed" ? "silent" : "unrunnable"
+        }, { exit_code: run.exit_code, duration_ms: run.duration_ms }));
+      }
+      const prior = await loadSensorLedger3(paths);
+      const health = new Map(assessSensorHealth3([...prior, ...ledgerRows]).map((h) => [h.memory_id, h]));
+      for (const run of runs) {
+        const sensorHealth = health.get(run.memory_id);
+        const quarantined = sensorHealth?.quarantine_pending === true;
+        if (quarantined && run.severity === "block") {
+          const last = sensorHealth.flaps.at(-1);
+          findings.push({
+            severity: "warn",
+            code: "sensor-flaky",
+            message: `Command sensor ${run.memory_id} flapped ${sensorHealth.flap_count}\xD7 on identical inputs; treated as warn pending sync quarantine. Last contradiction: ${last.previous.at} ${last.previous.outcome} \u2192 ${last.current.at} ${last.current.outcome}.`,
+            fix: "Run `hivelore sync`, fix the flaky oracle, then re-promote with `hivelore sensors promote <id> --yes`.",
+            impact: 5,
+            memory_ids: [run.memory_id]
+          });
+        }
         if (run.status === "passed") continue;
         seen.add(run.memory_id);
         if (run.status === "unrunnable") {
@@ -10815,14 +11076,15 @@ ${run.output_tail}` : ""),
         firedIds.add(run.memory_id);
         const outputBlock = run.output_tail ? `
 ${run.output_tail}` : "";
-        if (run.severity === "block") {
+        if (run.severity === "block" && !quarantined) {
           findings.push({
             severity: "error",
             code: "sensor-block",
             message: `Block ${run.kind} sensor fired \u2014 ${run.memory_id}: ${run.message}
 command: ${run.command} (exit ${run.exit_code}, ${run.duration_ms}ms)${outputBlock}`,
             fix: "Fix the behaviour the command checks, or run `hivelore sensors check --commands` to inspect it.",
-            impact: 45
+            impact: 45,
+            memory_ids: [run.memory_id]
           });
         } else {
           findings.push({
@@ -10830,13 +11092,19 @@ command: ${run.command} (exit ${run.exit_code}, ${run.duration_ms}ms)${outputBlo
             code: "sensor-warn",
             message: `${run.kind} sensor flagged ${run.memory_id}: ${run.message} (exit ${run.exit_code})${outputBlock}`,
             fix: "Review the failing command; `hivelore sensors check --commands` re-runs it.",
-            impact: 5
+            impact: 5,
+            memory_ids: [run.memory_id]
           });
         }
       }
     }
+    await appendSensorEvaluations(paths, ledgerRows);
     if (firedIds.size > 0) {
-      await recordPreventionHits(paths, [...firedIds], "sensor").catch(() => {
+      const details = Object.fromEntries([...firedIds].map((id) => {
+        const row = ledgerRows.find((entry) => entry.memory_id === id && entry.outcome === "fired");
+        return [id, { kind: row?.kind ?? "regex", stage, ...row?.exit_code !== void 0 ? { exit_code: row.exit_code } : {} }];
+      }));
+      await recordPreventionHits(paths, [...firedIds], "sensor", /* @__PURE__ */ new Date(), details).catch(() => {
       });
     }
     return findings;
@@ -11442,11 +11710,27 @@ ${hook.body}`, "utf8");
 async function installCiEnforcement(root) {
   const workflowPath = path39.join(root, ".github", "workflows", "haive-enforcement.yml");
   await mkdir16(path39.dirname(workflowPath), { recursive: true });
+  const workflow = renderCiEnforcementWorkflow();
   if (existsSync41(workflowPath)) {
-    ui.info("GitHub Actions enforcement workflow already exists \u2014 skipped");
+    const existing = await readFile18(workflowPath, "utf8");
+    const start = "# haive:enforcement-workflow:start";
+    const end = "# haive:enforcement-workflow:end";
+    const startAt = existing.indexOf(start);
+    const endAt = existing.indexOf(end);
+    if (startAt >= 0 && endAt > startAt) {
+      await writeFile25(workflowPath, existing.slice(0, startAt) + workflow + existing.slice(endAt + end.length), "utf8");
+      ui.success(`Updated ${path39.relative(root, workflowPath)} managed block`);
+    } else {
+      ui.info("GitHub Actions enforcement workflow already exists without Hivelore markers \u2014 preserved");
+    }
     return;
   }
-  await writeFile25(workflowPath, `name: haive-enforcement
+  await writeFile25(workflowPath, workflow, "utf8");
+  ui.success(`Created ${path39.relative(root, workflowPath)}`);
+}
+function renderCiEnforcementWorkflow() {
+  return `# haive:enforcement-workflow:start
+name: haive-enforcement
 
 on:
   pull_request:
@@ -11458,6 +11742,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -11468,12 +11753,51 @@ jobs:
       - name: Install Hivelore
         run: npm install -g @hivelore/cli
       - name: Enforce Hivelore policy
+        id: gate
         env:
           HAIVE_BASE_SHA: \${{ github.event.pull_request.base.sha || github.event.before }}
           HAIVE_HEAD_SHA: \${{ github.event.pull_request.head.sha || github.sha }}
-        run: hivelore enforce ci
-`, "utf8");
-  ui.success(`Created ${path39.relative(root, workflowPath)}`);
+        run: |
+          set +e
+          hivelore enforce ci --json > "$RUNNER_TEMP/haive-gate.json"
+          echo "exit_code=$?" >> "$GITHUB_OUTPUT"
+          exit 0
+      - name: Upsert prevention receipt
+        if: always() && github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: \${{ github.token }}
+          PR_NUMBER: \${{ github.event.pull_request.number }}
+        run: |
+          if [ -z "\${GH_TOKEN:-}" ] || ! command -v gh >/dev/null 2>&1; then exit 0; fi
+          receipt="$(hivelore stats receipt --since 7d --json 2>/dev/null)" || exit 0
+          gate="$(cat "$RUNNER_TEMP/haive-gate.json" 2>/dev/null)" || gate='{"findings":[]}'
+          body="$(jq -nr --arg marker '<!-- haive:prevention-receipt -->' --argjson receipt "$receipt" --argjson gate "$gate" '
+            $marker + "
+## Hivelore prevention receipt
+
+" +
+            (([$gate.findings[]? | select(.code == "sensor-block" or .code == "sensor-warn") |
+              "- **" + (.memory_ids[0] // "sensor") + "** \u2014 " + .message] | if length == 0 then
+              "No documented sensor fired on this PR." else "### Fired on this PR
+" + join("
+") end)) +
+            "
+
+Weekly total: **" + ($receipt.total|tostring) + "** refused; previous window: **" +
+            ($receipt.previous_total|tostring) + "**."
+          ')" || exit 0
+          comments="$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --paginate 2>/dev/null)" || exit 0
+          comment_id="$(printf '%s' "$comments" | jq -r '.[] | select(.body | contains("<!-- haive:prevention-receipt -->")) | .id' | head -1)"
+          if [ -n "$comment_id" ]; then
+            gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" -f body="$body" >/dev/null 2>&1 || true
+          else
+            gh api --method POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" -f body="$body" >/dev/null 2>&1 || true
+          fi
+      - name: Fail when enforcement blocked
+        if: steps.gate.outputs.exit_code != '0'
+        run: exit \${{ steps.gate.outputs.exit_code }}
+# haive:enforcement-workflow:end
+`;
 }
 function printReport(report, json, explain = false) {
   if (json) {
@@ -11658,9 +11982,9 @@ import { readFile as readFile19, writeFile as writeFile26 } from "fs/promises";
 import path40 from "path";
 import "commander";
 import { findProjectRoot as findProjectRoot38 } from "@hivelore/core";
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify5 } from "util";
-var exec3 = promisify5(execFile5);
+import { execFile as execFile6 } from "child_process";
+import { promisify as promisify6 } from "util";
+var exec4 = promisify6(execFile6);
 var VERSION_FILES2 = [
   "package.json",
   "packages/core/package.json",
@@ -11737,24 +12061,24 @@ ${heading}
         return;
       }
     }
-    const dirty = (await exec3("git", ["status", "--porcelain"], { cwd: root })).stdout.trim();
+    const dirty = (await exec4("git", ["status", "--porcelain"], { cwd: root })).stdout.trim();
     if (dirty.length > 0) {
       ui.error("Working tree is not clean \u2014 commit the bump before tagging.");
       process.exitCode = 1;
       return;
     }
     const tag = `v${version}`;
-    const existing = (await exec3("git", ["tag", "--list", tag], { cwd: root })).stdout.trim();
+    const existing = (await exec4("git", ["tag", "--list", tag], { cwd: root })).stdout.trim();
     if (existing) {
       ui.error(`Tag ${tag} already exists \u2014 bump the version first.`);
       process.exitCode = 1;
       return;
     }
-    await exec3("git", ["tag", tag], { cwd: root });
+    await exec4("git", ["tag", tag], { cwd: root });
     ui.success(`Created ${tag} at HEAD.`);
     if (opts.push !== false) {
-      await exec3("git", ["push"], { cwd: root });
-      await exec3("git", ["push", "origin", tag], { cwd: root });
+      await exec4("git", ["push"], { cwd: root });
+      await exec4("git", ["push", "origin", tag], { cwd: root });
       ui.success(`Pushed branch and ${tag}.`);
       ui.info("Next: `hivelore enforce finish --wait` (polls CI), then publish via `pnpm run publish:all` (human step).");
     }
@@ -11774,18 +12098,21 @@ function registerRun(program2) {
 }
 
 // src/commands/sensors.ts
-import { execFile as execFile6 } from "child_process";
+import { execFile as execFile7 } from "child_process";
 import { existsSync as existsSync43 } from "fs";
 import { chmod as chmod2, mkdir as mkdir17, readFile as readFile20, writeFile as writeFile27 } from "fs/promises";
 import path41 from "path";
-import { promisify as promisify6 } from "util";
+import { promisify as promisify7 } from "util";
 import "commander";
 import {
   extractSensorExamples,
+  appendSensorEvaluations as appendSensorEvaluations2,
+  assessSensorHealth as assessSensorHealth4,
   findProjectRoot as findProjectRoot39,
   isRetiredMemory as isRetiredMemory3,
   judgeProposedSensor,
   loadConfig as loadConfig13,
+  loadSensorLedger as loadSensorLedger4,
   loadMemoriesFromDir as loadMemoriesFromDir15,
   recordPreventionHits as recordPreventionHits2,
   resolveHaivePaths as resolveHaivePaths36,
@@ -11793,10 +12120,12 @@ import {
   selectCommandSensors as selectCommandSensors2,
   sensorPatternBrittleness as sensorPatternBrittleness2,
   sensorSelfCheck as sensorSelfCheck2,
+  sensorAppliesToPath as sensorAppliesToPath3,
   scannableSensorTargets,
-  serializeMemory as serializeMemory15
+  serializeMemory as serializeMemory15,
+  withoutQuarantineNote
 } from "@hivelore/core";
-var exec4 = promisify6(execFile6);
+var exec5 = promisify7(execFile7);
 function registerSensors(program2) {
   const sensors = program2.command("sensors").description("Operate executable sensors derived from Hivelore memories");
   sensors.command("list").description("List memories carrying executable sensors").option("--json", "emit JSON", false).option("-d, --dir <dir>", "project root").action(async (opts) => {
@@ -11843,12 +12172,44 @@ function registerSensors(program2) {
     const commandHits = [];
     const commandUnrunnable = [];
     const commandSkipped = [];
+    const ledgerRows = [];
+    const headSha = await gitHeadSha(root);
+    for (const memory2 of memories) {
+      const sensor = memory2.frontmatter.sensor;
+      if (!sensor || sensor.kind !== "regex") continue;
+      const anchors = memory2.frontmatter.anchor.paths;
+      const applicable = targets.some((target) => sensorAppliesToPath3(sensor, anchors, target.path));
+      if (!applicable) continue;
+      ledgerRows.push(evaluation({
+        memory_id: memory2.frontmatter.id,
+        kind: "regex",
+        stage: "manual",
+        head_sha: headSha,
+        scope_hash: "",
+        outcome: hits.some((hit) => hit.memory_id === memory2.frontmatter.id) ? "fired" : "silent"
+      }));
+    }
     if (commandSpecs.length > 0 && runCommands) {
-      for (const run of await executeCommandSensors(commandSpecs, root)) {
+      const runs = await executeCommandSensors(commandSpecs, root);
+      for (const run of runs) {
+        const spec = commandSpecs.find((candidate) => candidate.memory_id === run.memory_id);
+        ledgerRows.push(evaluation({
+          memory_id: run.memory_id,
+          kind: run.kind,
+          stage: "manual",
+          head_sha: headSha,
+          scope_hash: await commandScopeHash(root, spec),
+          outcome: run.status === "failed" ? "fired" : run.status === "passed" ? "silent" : "unrunnable"
+        }, { exit_code: run.exit_code, duration_ms: run.duration_ms }));
+      }
+      const prior = await loadSensorLedger4(paths);
+      const health = new Map(assessSensorHealth4([...prior, ...ledgerRows]).map((h) => [h.memory_id, h]));
+      for (const run of runs) {
+        const quarantined = health.get(run.memory_id)?.quarantine_pending === true;
         if (run.status === "failed") {
           commandHits.push({
             memory_id: run.memory_id,
-            severity: run.severity,
+            severity: quarantined ? "warn" : run.severity,
             message: run.message,
             matched_line: `command failed (exit ${run.exit_code}, ${run.duration_ms}ms): ${run.command}`,
             ...run.output_tail ? { output_tail: run.output_tail } : {}
@@ -11860,8 +12221,17 @@ function registerSensors(program2) {
     } else if (commandSpecs.length > 0) {
       for (const spec of commandSpecs) commandSkipped.push(spec.memory_id);
     }
+    await appendSensorEvaluations2(paths, ledgerRows);
     const firedIds = [...new Set([...hits, ...commandHits].map((hit) => hit.memory_id))];
-    await recordPreventionHits2(paths, firedIds, "sensor");
+    const preventionDetails = Object.fromEntries([
+      ...hits.map((hit) => [hit.memory_id, { kind: "regex", stage: "manual" }]),
+      ...commandHits.map((hit) => [hit.memory_id, {
+        kind: commandSpecs.find((spec) => spec.memory_id === hit.memory_id)?.kind ?? "shell",
+        stage: "manual",
+        exit_code: Number(/exit (\d+)/.exec(hit.matched_line)?.[1] ?? 1)
+      }])
+    ]);
+    await recordPreventionHits2(paths, firedIds, "sensor", /* @__PURE__ */ new Date(), preventionDetails);
     const output = {
       scanned: memories.length,
       hits: hits.map((hit) => ({
@@ -11968,7 +12338,7 @@ function registerSensors(program2) {
         ...found.memory.frontmatter,
         sensor: { ...sensor, severity }
       },
-      body: found.memory.body
+      body: severity === "block" ? withoutQuarantineNote(found.memory.body) : found.memory.body
     };
     await writeFile27(found.filePath, serializeMemory15(next), "utf8");
     ui.success(`Updated ${id}: sensor severity=${severity}`);
@@ -11985,7 +12355,7 @@ function registerSensors(program2) {
         return;
       }
       const root2 = findProjectRoot39(opts.dir);
-      const { proposeSensor } = await import("./server-FQ5C43MV.js");
+      const { proposeSensor } = await import("./server-2FUYM6KI.js");
       const out = await proposeSensor(
         {
           memory_id: id,
@@ -12132,7 +12502,7 @@ async function runnableSensorMemories(paths, regexOnly = true) {
 }
 async function stagedDiff(root) {
   try {
-    const { stdout } = await exec4("git", ["diff", "--cached"], { cwd: root });
+    const { stdout } = await exec5("git", ["diff", "--cached"], { cwd: root });
     return stdout;
   } catch (err) {
     throw new Error(`git diff --cached failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -12372,7 +12742,7 @@ import {
   findProjectRoot as findProjectRoot41,
   loadConfig as loadConfig14,
   loadMemoriesFromDir as loadMemoriesFromDir17,
-  loadPreventionEvents as loadPreventionEvents3,
+  loadPreventionEvents as loadPreventionEvents4,
   loadUsageIndex as loadUsageIndex16,
   resolveHaivePaths as resolveHaivePaths38
 } from "@hivelore/core";
@@ -12389,7 +12759,7 @@ function registerDashboard(program2) {
     }
     const memories = existsSync45(paths.memoriesDir) ? await loadMemoriesFromDir17(paths.memoriesDir) : [];
     const usage = await loadUsageIndex16(paths);
-    const preventionEvents = await loadPreventionEvents3(paths);
+    const preventionEvents = await loadPreventionEvents4(paths);
     const config = await loadConfig14(paths);
     const top = Math.max(1, Number.parseInt(opts.top ?? "10", 10) || 10);
     const dormantDays = opts.dormantDays ? Number.parseInt(opts.dormantDays, 10) : void 0;
@@ -12511,14 +12881,14 @@ function warnNum(n) {
 }
 
 // src/commands/dev-link.ts
-import { execFile as execFile7 } from "child_process";
+import { execFile as execFile8 } from "child_process";
 import { cp, readFile as readFile22 } from "fs/promises";
 import { existsSync as existsSync46 } from "fs";
 import path43 from "path";
-import { promisify as promisify7 } from "util";
+import { promisify as promisify8 } from "util";
 import "commander";
 import { findProjectRoot as findProjectRoot42 } from "@hivelore/core";
-var exec5 = promisify7(execFile7);
+var exec6 = promisify8(execFile8);
 function registerDevLink(program2) {
   const dev = program2.commands.find((c) => c.name() === "dev") ?? program2.command("dev").description("Developer utilities for working on Hivelore itself.");
   dev.command("link").description("Hot-swap this repo's built dist into the global @hivelore (or legacy @hiveai) install so the global binary runs your local code.").option("-d, --dir <dir>", "repo root (default: discovered from cwd)").option("--json", "emit a machine-readable summary", false).action(async (opts) => {
@@ -12530,7 +12900,7 @@ function registerDevLink(program2) {
     }
     let globalModules;
     try {
-      globalModules = (await exec5("npm", ["root", "-g"])).stdout.trim();
+      globalModules = (await exec6("npm", ["root", "-g"])).stdout.trim();
     } catch {
       globalModules = path43.join(path43.dirname(path43.dirname(process.execPath)), "lib", "node_modules");
     }
@@ -12822,7 +13192,7 @@ function registerBridges(program2) {
 
 // src/index.ts
 var program = new Command48();
-program.name("hivelore").description("Hivelore - repo-native memory and context policy for coding-agent harnesses").version("0.34.1").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
+program.name("hivelore").description("Hivelore - repo-native memory and context policy for coding-agent harnesses").version("0.35.0").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
 registerInit(program);
 registerResolveProject(program);
 registerEnforce(program);