@hivelore/cli 0.39.2 → 0.43.2

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import {
   antiPatternsCheck,
+  astEngineAvailable,
   codeMapTool,
   codeSearch,
   detectTestFrameworksForAnchors,
@@ -10,8 +11,9 @@ import {
   memTried,
   preCommitCheck,
   readPresumedCorrectTargets,
+  runAstSensorOnContent,
   runHaiveMcpStdio
-} from "./chunk-XA5FXG6E.js";
+} from "./chunk-FXDGOBPT.js";
 import {
   registerMemoryPending
 } from "./chunk-OYJKHD22.js";
@@ -3756,7 +3758,7 @@ ${SEED_FOOTER(stack)}` });
 
 // src/commands/init.ts
 var execFileAsync = promisify2(execFile2);
-var HAIVE_GITHUB_ACTION_REF = `v${"0.39.2"}`;
+var HAIVE_GITHUB_ACTION_REF = `v${"0.43.2"}`;
 var PROJECT_CONTEXT_TEMPLATE = `# Project context
 
 > Generated by \`hivelore init\`. Run \`hivelore init --bootstrap\` to auto-fill from your codebase,
@@ -4714,6 +4716,7 @@ import { existsSync as existsSync14 } from "fs";
 import path15 from "path";
 import "commander";
 import {
+  appendProposedRetrievalCases,
   DEFAULT_AUTO_PROMOTE_RULE,
   assessSensorHealth,
   sensorPromotedAtMap,
@@ -4882,7 +4885,7 @@ function registerSync(program2) {
           promoted++;
           continue;
         }
-        if (autoApproveDelayHours !== null && fm.status === "proposed" && fm.scope === "team") {
+        if (autoApproveDelayHours !== null && fm.status === "proposed" && fm.scope === "team" && !fm.tags.includes("auto-captured")) {
           const ageHours = (nowMs - new Date(fm.created_at).getTime()) / (1e3 * 60 * 60);
           if (ageHours >= autoApproveDelayHours) {
             if (!dryRun) {
@@ -4917,6 +4920,25 @@ function registerSync(program2) {
     const gateMissIds = await processGateMissWatch(root, paths, dryRun);
     if (gateMissIds.length > 0) {
       log(ui.yellow(`gate-miss: proposed ${gateMissIds.length} lesson(s): ${gateMissIds.join(", ")}`));
+      if (!dryRun) {
+        try {
+          const freshlyLoaded = await loadMemoriesFromDir7(paths.memoriesDir);
+          const cases = gateMissIds.flatMap((id) => {
+            const loaded = freshlyLoaded.find((m) => m.memory.frontmatter.id === id);
+            const heading = loaded?.memory.body.match(/^#\s+(.+)$/m)?.[1]?.trim();
+            if (!heading) return [];
+            return [{ name: `gate-miss:${id}`, task: heading, expect_ids: [id] }];
+          });
+          if (cases.length > 0) {
+            const specFile = path15.join(root, ".ai", "eval", "spec.json");
+            const raw = existsSync14(specFile) ? await readFile7(specFile, "utf8") : null;
+            await mkdir8(path15.dirname(specFile), { recursive: true });
+            await writeFile8(specFile, appendProposedRetrievalCases(raw, cases), "utf8");
+            log(ui.dim(`gate-miss: ${cases.length} proposed golden eval case(s) \u2192 .ai/eval/spec.json (approve with \`hivelore eval --approve-cases\`)`));
+          }
+        } catch {
+        }
+      }
     }
     const draftMemories = (await loadMemoriesFromDir7(paths.memoriesDir)).filter(
       (m) => m.memory.frontmatter.status === "draft"
@@ -6946,6 +6968,7 @@ import { spawn as spawn2 } from "child_process";
 import path29 from "path";
 import { Option as Option2 } from "commander";
 import {
+  distillFailureObservations,
   buildFrontmatter as buildFrontmatter5,
   findProjectRoot as findProjectRoot27,
   loadConfig as loadConfig6,
@@ -7128,6 +7151,65 @@ function runGit(cwd, args) {
     });
   });
 }
+async function readObservationList(paths) {
+  const obsFile = path29.join(paths.haiveDir, ".cache", "observations.jsonl");
+  if (!existsSync32(obsFile)) return [];
+  const raw = await readFile13(obsFile, "utf8").catch(() => "");
+  const out = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      out.push(JSON.parse(line));
+    } catch {
+    }
+  }
+  return out;
+}
+async function autoCaptureFailureLessons(paths, root, observations) {
+  const failures = observations.filter((o) => o.failure_hint).map((o) => ({
+    ts: o.ts,
+    tool: o.tool,
+    summary: o.summary,
+    files: (o.files ?? []).map((f) => normalizeAnchorPath(root, f)).filter((f) => existsSync32(path29.resolve(root, f)))
+  }));
+  if (failures.length === 0) return { written: 0, ids: [] };
+  const lessons = distillFailureObservations(failures, { max: 3 });
+  if (lessons.length === 0) return { written: 0, ids: [] };
+  const existing = existsSync32(paths.memoriesDir) ? await loadMemoriesFromDir10(paths.memoriesDir) : [];
+  const normalizeTitle = (t) => t.toLowerCase().replace(/\s+/g, " ").trim().slice(0, 120);
+  const existingTitles = new Set(
+    existing.filter(({ memory: memory2 }) => memory2.frontmatter.type === "attempt").map(({ memory: memory2 }) => normalizeTitle(memory2.body.match(/^#\s+(.+)$/m)?.[1] ?? ""))
+  );
+  let written = 0;
+  const ids = [];
+  for (const lesson of lessons) {
+    if (existingTitles.has(normalizeTitle(lesson.what))) continue;
+    const slug = lesson.what.toLowerCase().replace(/[^a-z0-9\s]/g, "").trim().split(/\s+/).slice(0, 6).join("-") || "auto-captured-failure";
+    const baseFm = buildFrontmatter5({
+      type: "attempt",
+      slug,
+      scope: "personal",
+      tags: ["auto-captured"],
+      paths: lesson.paths
+    });
+    const frontmatter = { ...baseFm, status: "proposed" };
+    const file = memoryFilePath5(paths, frontmatter.scope, frontmatter.id, frontmatter.module);
+    if (existsSync32(file)) continue;
+    const body = `# ${lesson.what}
+
+**Why it failed / do NOT use:** ${lesson.why_failed}
+
+_Auto-captured from session observations (${lesson.occurrences} occurrence${lesson.occurrences === 1 ? "" : "s"}). Review: refine and approve (\`hivelore memory approve ${frontmatter.id}\`), or reject it._
+`;
+    await mkdir11(path29.dirname(file), { recursive: true });
+    await writeFile17(file, serializeMemory12({ frontmatter, body }), "utf8").catch(() => {
+    });
+    existingTitles.add(normalizeTitle(lesson.what));
+    written++;
+    ids.push(frontmatter.id);
+  }
+  return { written, ids };
+}
 async function observationStart(paths) {
   const obsFile = path29.join(paths.haiveDir, ".cache", "observations.jsonl");
   if (!existsSync32(obsFile)) return null;
@@ -7195,11 +7277,18 @@ function registerSessionEnd(session2) {
     let accomplished = opts.accomplished ?? opts.summary;
     const caughtSince = opts.auto ? await observationStart(paths) : null;
     if (opts.auto) {
+      const autoCaptured = await autoCaptureFailureLessons(paths, root, await readObservationList(paths)).catch(() => ({ written: 0, ids: [] }));
       const synth = await buildAutoRecap(paths);
       if (!synth) return;
       goal = goal ?? synth.goal;
       accomplished = accomplished ?? synth.accomplished;
       opts.discoveries = opts.discoveries ?? synth.discoveries;
+      if (autoCaptured.written > 0) {
+        const note = `${autoCaptured.written} failure(s) auto-captured as proposed lesson(s): ${autoCaptured.ids.join(", ")} \u2014 review with \`hivelore memory list --status proposed\` (approve, refine, or reject).`;
+        opts.discoveries = opts.discoveries ? `${opts.discoveries}
+${note}` : note;
+        if (!opts.quiet) ui.info(note);
+      }
       if (!resolvedFiles && synth.files.length) resolvedFiles = synth.files.join(",");
     }
     if (!goal || !accomplished) {
@@ -7668,7 +7757,9 @@ function registerBenchmark(program2) {
       "   - Hivelore agents must run `hivelore briefing --files ... --task ...` first.",
       "   - Plain agents must not read `.ai` or call Hivelore.",
       "5. Require every agent to write `BENCHMARK_AGENT_REPORT.md`.",
+      "   Its `## Outcome` section must include: Task completed, Tests passed, Policy violations, Duration seconds, Total tokens.",
       "6. Run `hivelore benchmark report --dir <benchmark-root> --out RESULTS.md`.",
+      "7. Do not make comparative claims until evidence_grade=decision-ready (>=10 paired tasks with complete outcomes).",
       "",
       "Recommended metrics: pass rate, test iterations, files read, files changed, visible artifacts, decision quality, and token proxy."
     ].join("\n"));
@@ -7706,15 +7797,32 @@ function parseAgentReport(fixture, report) {
     terminal_failures: countMatches(section(report, "Terminal Errors"), /fail|error|not raised|exited with code 1/gi),
     decision_mentions: sectionBulletCount(report, "Key Decisions"),
     report_tokens_est: estimateTokens2(report),
-    haive_impact: /Hivelore Memory Impact[\s\S]*?\b(yes|directly|changed|shaped|confirmed)\b/i.test(report)
+    haive_impact: /Hivelore Memory Impact[\s\S]*?\b(yes|directly|changed|shaped|confirmed)\b/i.test(report),
+    task_completed: reportBoolean(report, "Task completed"),
+    tests_passed: reportBoolean(report, "Tests passed"),
+    policy_violations: reportNumber(report, "Policy violations"),
+    duration_seconds: reportNumber(report, "Duration seconds"),
+    total_tokens: reportNumber(report, "Total tokens")
   };
 }
 function summarizeRows(rows) {
   const byGroup = (group) => rows.filter((r) => r.group === group);
+  const haiveRows = byGroup("haive");
+  const plainRows = byGroup("plain");
+  const taskName = (fixture) => fixture.replace(/-(haive|plain)$/, "");
+  const plainTasks = new Set(plainRows.map((row) => taskName(row.fixture)));
+  const pairedTasks = new Set(haiveRows.map((row) => taskName(row.fixture)).filter((name) => plainTasks.has(name))).size;
+  const outcomeComplete = rows.length > 0 && rows.every(
+    (row) => row.task_completed !== null && row.tests_passed !== null && row.policy_violations !== null && row.duration_seconds !== null && row.total_tokens !== null
+  );
+  const decisionReady = pairedTasks >= 10 && outcomeComplete;
   return {
     fixtures: rows.length,
-    haive: summarizeGroup(byGroup("haive")),
-    plain: summarizeGroup(byGroup("plain"))
+    paired_tasks: pairedTasks,
+    evidence_grade: decisionReady ? "decision-ready" : "insufficient",
+    evidence_reason: decisionReady ? "At least 10 paired tasks with complete correctness, policy, duration, and token outcomes." : `Need >=10 paired tasks and complete Outcome fields; found ${pairedTasks} pair(s), outcome_complete=${outcomeComplete}.`,
+    haive: summarizeGroup(haiveRows),
+    plain: summarizeGroup(plainRows)
   };
 }
 function summarizeGroup(rows) {
@@ -7728,7 +7836,12 @@ function summarizeGroup(rows) {
     terminal_failures: sum("terminal_failures"),
     decision_mentions: sum("decision_mentions"),
     report_tokens_est: sum("report_tokens_est"),
-    haive_impact_count: rows.filter((r) => r.haive_impact).length
+    haive_impact_count: rows.filter((r) => r.haive_impact).length,
+    completed: rows.filter((r) => r.task_completed === true).length,
+    tests_passed: rows.filter((r) => r.tests_passed === true).length,
+    policy_violations: rows.reduce((total, row) => total + (row.policy_violations ?? 0), 0),
+    duration_seconds: rows.reduce((total, row) => total + (row.duration_seconds ?? 0), 0),
+    total_tokens: rows.reduce((total, row) => total + (row.total_tokens ?? 0), 0)
   };
 }
 function renderMarkdown(root, summary, rows) {
@@ -7739,6 +7852,8 @@ function renderMarkdown(root, summary, rows) {
     "",
     "## Summary",
     "",
+    `Evidence grade: **${summary.evidence_grade}** \u2014 ${summary.evidence_reason}`,
+    "",
     "| Group | Fixtures | Commands | Files read | Files modified | Test iterations | Terminal failures | Decision mentions | Report tokens (est, report only) | Hivelore impact |",
     "| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |",
     groupLine("Hivelore", summary.haive),
@@ -7762,6 +7877,23 @@ function renderMarkdown(root, summary, rows) {
   ];
   return lines.join("\n");
 }
+function reportValue(report, label) {
+  const match = new RegExp(`^[-*]\\s*${escapeRegExp(label)}\\s*:\\s*(.+)$`, "im").exec(report);
+  return match?.[1]?.trim() ?? null;
+}
+function reportBoolean(report, label) {
+  const value = reportValue(report, label);
+  if (!value) return null;
+  if (/^(yes|true|pass|passed|complete|completed)$/i.test(value)) return true;
+  if (/^(no|false|fail|failed|incomplete)$/i.test(value)) return false;
+  return null;
+}
+function reportNumber(report, label) {
+  const value = reportValue(report, label);
+  if (!value) return null;
+  const parsed = Number(value.replace(/,/g, ""));
+  return Number.isFinite(parsed) ? parsed : null;
+}
 function groupLine(label, group) {
   return `| ${label} | ${group.fixtures} | ${group.commands} | ${group.files_read} | ${group.files_modified} | ${group.test_iterations} | ${group.terminal_failures} | ${group.decision_mentions} | ${group.report_tokens_est} | ${group.haive_impact_count} |`;
 }
@@ -7798,7 +7930,9 @@ import {
   loadEvalHistory,
   loadPreventionEvents as loadPreventionEvents3,
   loadUsageIndex as loadUsageIndex13,
+  approveProposedCases,
   overallScore,
+  runTierContract,
   resolveHaivePaths as resolveHaivePaths29,
   scoreRetrievalCase,
   scoreSensorCase,
@@ -7807,7 +7941,7 @@ import {
 function registerEval(program2) {
   program2.command("eval").description(
     "Rigorous, repeatable quality eval: do the right memories surface (retrieval) and do the right sensors fire (catch-rate)? Emits a numeric 0\u2013100 score. Uses .ai/eval cases via --spec, or auto-synthesizes cases from anchored memories."
-  ).option("--spec <file>", "JSON eval spec ({ retrieval: [...], sensors: [...] })").option("--semantic-only", "self-eval probes by title alone (no anchor files) \u2014 harder retrieval", false).option("-k, --top <n>", "briefing top-k considered a hit", "8").option("--json", "emit JSON", false).option("--out <file>", "write a Markdown report").option("--fail-under <score>", "exit non-zero if the overall score is below this (0\u2013100) \u2014 for CI gates").option("--fail-under-catch-rate <pct>", "exit non-zero if sensor catch-rate is below this percentage").option("--fail-under-gate-precision <pct>", "exit non-zero if gate precision is below this percentage").option("--baseline", "save this run as the baseline (.ai/eval/baseline.json) for future --compare", false).option("--compare", "diff this run against the saved baseline and print the delta", false).option("--baseline-file <path>", "baseline file to read/write (default: .ai/eval/baseline.json)").option("--fail-on-regression", "with --compare, exit non-zero if the score dropped vs the baseline", false).option("--regression-gate", "CI-safe gate: compare against the baseline IF one exists (fail on regression), else no-op", false).option("--record", "append this run's score to .ai/.cache/eval-history.jsonl (trend the harness over time)", false).option("--trend", "print the recorded score trend (sparkline + latest/best/delta) and exit", false).option("--ref <ref>", "version/commit label stored with a --record run").option("-d, --dir <dir>", "project root").action(async (opts) => {
+  ).option("--spec <file>", "JSON eval spec ({ retrieval: [...], sensors: [...] })").option("--semantic-only", "self-eval probes by title alone (no anchor files) \u2014 harder retrieval", false).option("-k, --top <n>", "briefing top-k considered a hit", "8").option("--json", "emit JSON", false).option("--out <file>", "write a Markdown report").option("--fail-under <score>", "exit non-zero if the overall score is below this (0\u2013100) \u2014 for CI gates").option("--fail-under-catch-rate <pct>", "exit non-zero if sensor catch-rate is below this percentage").option("--fail-under-gate-precision <pct>", "exit non-zero if gate precision is below this percentage").option("--baseline", "save this run as the baseline (.ai/eval/baseline.json) for future --compare", false).option("--compare", "diff this run against the saved baseline and print the delta", false).option("--baseline-file <path>", "baseline file to read/write (default: .ai/eval/baseline.json)").option("--fail-on-regression", "with --compare, exit non-zero if the score dropped vs the baseline", false).option("--regression-gate", "CI-safe gate: compare against the baseline IF one exists (fail on regression), else no-op", false).option("--approve-cases", "approve every proposed golden case (gate-miss labeled) into the scored retrieval set, then exit", false).option("--record", "append this run's score to .ai/.cache/eval-history.jsonl (trend the harness over time)", false).option("--trend", "print the recorded score trend (sparkline + latest/best/delta) and exit", false).option("--ref <ref>", "version/commit label stored with a --record run").option("-d, --dir <dir>", "project root").action(async (opts) => {
     const root = findProjectRoot31(opts.dir);
     const paths = resolveHaivePaths29(root);
     if (!existsSync35(paths.memoriesDir)) {
@@ -7815,6 +7949,21 @@ function registerEval(program2) {
       process.exitCode = 1;
       return;
     }
+    if (opts.approveCases) {
+      const specFile = path32.join(root, ".ai", "eval", "spec.json");
+      if (!existsSync35(specFile)) {
+        ui.info("No .ai/eval/spec.json \u2014 nothing to approve.");
+        return;
+      }
+      const { raw, approved } = approveProposedCases(await readFile15(specFile, "utf8"));
+      if (approved === 0) {
+        ui.info("No proposed cases waiting for approval.");
+        return;
+      }
+      await writeFile20(specFile, raw, "utf8");
+      ui.success(`Approved ${approved} proposed golden case(s) into the scored retrieval set.`);
+      return;
+    }
     if (opts.trend) {
       const trend = computeEvalTrend(await loadEvalHistory(paths));
       if (opts.json) {
@@ -7835,6 +7984,17 @@ function registerEval(program2) {
     const ctx = { paths };
     const resolvedSpec = await resolveSpec(opts, root, paths.memoriesDir);
     const spec = resolvedSpec.spec;
+    const tierChecks = runTierContract();
+    const tierFailures = tierChecks.filter((c) => !c.pass);
+    let proposedGoldenCount = 0;
+    try {
+      const specFile = path32.join(root, ".ai", "eval", "spec.json");
+      if (!opts.spec && existsSync35(specFile)) {
+        const parsed = JSON.parse(await readFile15(specFile, "utf8"));
+        proposedGoldenCount = parsed.proposed_retrieval?.length ?? 0;
+      }
+    } catch {
+    }
     if ((spec.retrieval?.length ?? 0) === 0 && (spec.sensors?.length ?? 0) === 0) {
       ui.warn("No eval cases (no anchored memories and no --spec). Nothing to score.");
       return;
@@ -7861,6 +8021,8 @@ function registerEval(program2) {
     const authoredRetrievalCases = retrievalAgg ? retrievalAgg.cases.slice(resolvedSpec.synthesized) : [];
     const authoredRetrievalAgg = authoredRetrievalCases.length > 0 ? aggregateRetrieval(authoredRetrievalCases) : null;
     const authoredScore = resolvedSpec.authored > 0 && resolvedSpec.synthesized > 0 && (authoredRetrievalAgg || sensorAgg) ? overallScore(authoredRetrievalAgg, sensorAgg) : null;
+    const authoredReport = resolvedSpec.authored > 0 && (authoredRetrievalAgg || sensorAgg) ? buildReport(authoredRetrievalAgg, sensorAgg) : null;
+    const gateReport = authoredReport ?? report;
     const [usage, preventionEvents, config] = await Promise.all([
       loadUsageIndex13(paths),
       loadPreventionEvents3(paths),
@@ -7889,6 +8051,7 @@ function registerEval(program2) {
         k,
         spec_source: resolvedSpec.source,
         report,
+        ...authoredReport ? { authored_report: authoredReport } : {},
         gate_precision: gatePrecision
       };
       await mkdir13(path32.dirname(baselineFile), { recursive: true });
@@ -7908,7 +8071,7 @@ function registerEval(program2) {
         }
       } else {
         const snapshot = JSON.parse(await readFile15(baselineFile, "utf8"));
-        delta = compareEvalReports(snapshot.report, report);
+        delta = compareEvalReports(snapshot.authored_report ?? snapshot.report, gateReport);
         if (snapshot.gate_precision) {
           gateDelta = compareGatePrecision(snapshot.gate_precision, gatePrecision);
         }
@@ -7925,11 +8088,15 @@ function registerEval(program2) {
           ...authoredScore !== null ? { authored_score: authoredScore } : {}
         },
         report,
+        ...authoredReport ? { authored_report: authoredReport } : {},
+        tier_contract: { checks: tierChecks, failures: tierFailures.length },
+        proposed_golden_cases: proposedGoldenCount,
         gate_precision: gatePrecision,
         ...delta ? { delta } : {},
         ...gateDelta ? { gate_delta: gateDelta } : {}
       }, null, 2));
-      applyExitGates(opts, report, delta, gatePrecision, gateDelta);
+      if (tierFailures.length > 0) process.exitCode = 1;
+      applyExitGates(opts, gateReport, delta, gatePrecision, gateDelta);
       return;
     }
     if (resolvedSpec.authored === 0 && resolvedSpec.synthesized > 0) {
@@ -7943,6 +8110,17 @@ function registerEval(program2) {
     if (gateDelta) {
       console.log(renderGateDelta(gateDelta));
     }
+    if (tierFailures.length > 0) {
+      ui.error(`Ranking tier contract BROKEN \u2014 ${tierFailures.length} check(s) violate the designed tiers:`);
+      for (const c of tierFailures) ui.error(`  \u2717 ${c.name} (expected ${c.expected}, got ${c.actual})`);
+    } else {
+      ui.info(`Ranking tier contract: ${tierChecks.length}/${tierChecks.length} checks hold.`);
+    }
+    if (proposedGoldenCount > 0) {
+      ui.warn(
+        `${proposedGoldenCount} proposed golden case(s) (gate-miss labeled) await approval \u2014 review .ai/eval/spec.json, then \`hivelore eval --approve-cases\` to score them.`
+      );
+    }
     const md = renderMarkdown2(root, k, resolvedSpec, report, gatePrecision, authoredScore);
     if (opts.out) {
       const outFile = path32.isAbsolute(opts.out) ? opts.out : path32.join(root, opts.out);
@@ -7951,7 +8129,8 @@ function registerEval(program2) {
     } else {
       console.log(md);
     }
-    applyExitGates(opts, report, delta, gatePrecision, gateDelta);
+    if (tierFailures.length > 0) process.exitCode = 1;
+    applyExitGates(opts, gateReport, delta, gatePrecision, gateDelta);
   });
 }
 function parsePctThreshold(label, raw) {
@@ -8040,7 +8219,7 @@ async function resolveSpec(opts, root, memoriesDir) {
   if (existsSync35(defaultSpec)) {
     const raw = await readFile15(defaultSpec, "utf8");
     const explicit = JSON.parse(raw);
-    const memories2 = await loadMemoriesFromDir(memoriesDir);
+    const memories2 = (await loadMemoriesFromDir(memoriesDir)).filter(({ memory: memory2 }) => memory2.frontmatter.scope !== "personal");
     const synthesized2 = synthesizeSelfEvalCases(memories2, { includeFiles: !opts.semanticOnly });
     return {
       spec: {
@@ -8052,7 +8231,7 @@ async function resolveSpec(opts, root, memoriesDir) {
       authored: countCases(explicit)
     };
   }
-  const memories = await loadMemoriesFromDir(memoriesDir);
+  const memories = (await loadMemoriesFromDir(memoriesDir)).filter(({ memory: memory2 }) => memory2.frontmatter.scope !== "personal");
   const synthesized = synthesizeSelfEvalCases(memories, { includeFiles: !opts.semanticOnly });
   return {
     spec: { retrieval: synthesized },
@@ -8074,6 +8253,8 @@ async function runRetrieval(c, k, ctx) {
       semantic: true,
       include_stale: false,
       track: false,
+      memory_scopes: ["team", "module"],
+      deterministic: true,
       format: "compact",
       min_semantic_score: 0
     },
@@ -8894,6 +9075,45 @@ function registerDoctor(program2) {
         fix: "hivelore sensors list   # then `hivelore sensors promote <id>` for a trusted, non-brittle sensor \u2014 or retire the noise"
       });
     }
+    const commandSensorMemories = sensorMemories.filter((m) => {
+      const kind = m.memory.frontmatter.sensor?.kind;
+      return kind === "shell" || kind === "test";
+    });
+    if (commandSensorMemories.length > 0 && config.enforcement?.runCommandSensors !== true) {
+      findings.push({
+        severity: "error",
+        code: "command-sensors-disabled",
+        section: "Protection",
+        message: `${commandSensorMemories.length} command/test sensor(s) exist but enforcement.runCommandSensors is not true \u2014 their behaviour protection is OFF.`,
+        fix: "Set enforcement.runCommandSensors=true after reviewing the repo-authored commands."
+      });
+    }
+    const unprovenBlocks = commandSensorMemories.filter((m) => {
+      const sensor = m.memory.frontmatter.sensor;
+      return sensor.severity === "block" && sensor.red_proven !== true;
+    });
+    if (unprovenBlocks.length > 0) {
+      findings.push({
+        severity: "error",
+        code: "command-sensors-block-without-red",
+        section: "Protection",
+        message: `${unprovenBlocks.length} blocking command/test sensor(s) predate mandatory prove-RED and cannot substantiate their incident claim.`,
+        fix: "Re-propose each sensor with --red-ref <pre-fix-commit>, or demote it to warn."
+      });
+    }
+    const astSensorCount = sensorMemories.filter((m) => m.memory.frontmatter.sensor?.kind === "ast").length;
+    if (astSensorCount > 0) {
+      const { astEngineAvailable: astEngineAvailable2 } = await import("./server-WW6JHBYY.js");
+      if (!await astEngineAvailable2()) {
+        findings.push({
+          severity: "warn",
+          code: "ast-engine-missing",
+          section: "Protection",
+          message: `${astSensorCount} AST sensor(s) exist but the optional @ast-grep/napi engine is not installed \u2014 they are unrunnable on this machine (warn-only at the gate, protection OFF).`,
+          fix: "npm i -g @ast-grep/napi   # or add it to the repo devDependencies"
+        });
+      }
+    }
     const firesOnCurrent = [];
     for (const m of sensorMemories) {
       const s = m.memory.frontmatter.sensor;
@@ -9053,7 +9273,7 @@ function registerDoctor(program2) {
         fix: "Edit .ai/haive.config.json: set autoSessionEnd: true (or re-run `hivelore init` without --manual)."
       });
     }
-    findings.push(...await collectInstallFindings(root, "0.39.2"));
+    findings.push(...await collectInstallFindings(root, "0.43.2"));
     findings.push(...await collectToolchainFindings(root));
     try {
       const legacyRaw = execSync("haive-mcp --version", {
@@ -9061,7 +9281,7 @@ function registerDoctor(program2) {
         timeout: 3e3,
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
-      const cliVersion = "0.39.2";
+      const cliVersion = "0.43.2";
       if (legacyRaw && legacyRaw !== cliVersion) {
         findings.push({
           severity: "warn",
@@ -9806,6 +10026,7 @@ import {
   assessSensorHealth as assessSensorHealth3,
   sensorPromotedAtMap as sensorPromotedAtMap3,
   assessBootstrapState,
+  addedLineNumbersFromDiff,
   detectSensorWeakening,
   isSensorScannablePath,
   findProjectRoot as findProjectRoot37,
@@ -9959,6 +10180,7 @@ function defaultClaudeSettingsPath(scope, projectRoot) {
 // src/utils/command-sensors.ts
 import { execFile as execFile3 } from "child_process";
 import { promisify as promisify3 } from "util";
+import { scrubbedCommandEnv } from "@hivelore/core";
 var exec2 = promisify3(execFile3);
 var COMMAND_SENSOR_DEFAULT_TIMEOUT_MS = 12e4;
 var OUTPUT_TAIL_LINES = 15;
@@ -9982,7 +10204,9 @@ async function executeCommandSensor(spec, root) {
       cwd: root,
       timeout: timeoutMs,
       maxBuffer: 8 * 1024 * 1024,
-      env: { ...process.env, HIVELORE_SENSOR: spec.memory_id }
+      // Scrubbed on purpose: a repo-authored oracle gets a test-runner environment, not the
+      // caller's credentials (cloud keys, tokens). See scrubbedCommandEnv in core.
+      env: { ...scrubbedCommandEnv(process.env), HIVELORE_SENSOR: spec.memory_id }
     });
     return {
       ...base,
@@ -10583,11 +10807,14 @@ async function checkFailureCapture(paths, config) {
       message: "No uncaptured hard failures from this session."
     }];
   }
+  const autoDrafts = memories.filter(
+    ({ memory: memory2 }) => memory2.frontmatter.status === "proposed" && memory2.frontmatter.tags.includes("auto-captured")
+  );
   return [{
     severity: gate === "block" ? "error" : "info",
     code: "uncaptured-failures",
-    message: `${uncaptured.length} hard failure(s) this session were never captured as a lesson (mem_tried).`,
-    fix: "Call `mem_tried` (or `hivelore memory tried`) for each real failure so the next session doesn't repeat it. False positives (e.g. a grep that found nothing) can be ignored.",
+    message: `${uncaptured.length} hard failure(s) this session were never captured as a lesson (mem_tried).` + (autoDrafts.length > 0 ? ` ${autoDrafts.length} auto-captured draft(s) are waiting for review: ${autoDrafts.slice(0, 3).map(({ memory: memory2 }) => memory2.frontmatter.id).join(", ")}${autoDrafts.length > 3 ? ", \u2026" : ""}.` : ""),
+    fix: autoDrafts.length > 0 ? "Review the auto-captured drafts (`hivelore memory list --status proposed`) \u2014 approve, refine, or reject; call `mem_tried` only for failures the drafts missed." : "Call `mem_tried` (or `hivelore memory tried`) for each real failure so the next session doesn't repeat it. False positives (e.g. a grep that found nothing) can be ignored.",
     reason: "Harness ratchet: a mistake that isn't written down gets re-introduced. Set enforcement.failureCaptureGate to 'off' to disable, or 'block' to hard-fail.",
     affected_files: uncaptured.slice(0, 8).map((f) => `${f.tool}: ${f.summary}`.slice(0, 100)),
     ...gate === "block" ? { impact: 30 } : {}
@@ -10647,6 +10874,22 @@ async function runWithEnforcement(command, args, opts) {
     child.on("close", (code, signal) => {
       if (signal) process.exit(128);
       process.exitCode = code ?? 0;
+      if ((code ?? 0) !== 0) {
+        const obsFile = path40.join(paths.haiveDir, ".cache", "observations.jsonl");
+        void mkdir16(path40.dirname(obsFile), { recursive: true }).then(() => writeFile25(obsFile, "", { flag: "a" })).then(() => writeFile25(
+          obsFile,
+          JSON.stringify({
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            session_id: sessionId,
+            tool: "AgentRun",
+            summary: `wrapped agent exited ${code}: ${[command, ...args].join(" ").slice(0, 180)}`,
+            failure_hint: true
+          }) + "\n",
+          { flag: "a" }
+        )).catch(() => {
+        }).finally(() => resolve());
+        return;
+      }
       resolve();
     });
   });
@@ -10721,7 +10964,7 @@ async function checkBootstrapComplete(paths, config, productionCodeChanged) {
   }
   const memories = existsSync42(paths.memoriesDir) ? await loadMemoriesFromDir15(paths.memoriesDir) : [];
   const codeMap = await loadCodeMap7(paths);
-  const codeFiles = codeMap ? Object.keys(codeMap.files) : [];
+  const codeFiles = codeMap ? Object.keys(codeMap.files).filter((file) => existsSync42(path40.join(paths.root, file))) : [];
   let existingModules = [];
   try {
     const entries = await readdir4(paths.modulesContextDir, { withFileTypes: true });
@@ -10785,7 +11028,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
       findings: [{ severity: "info", code: "enforcement-off", message: "Hivelore enforcement is disabled." }]
     });
   }
-  findings.push(...await inspectIntegrationVersions(root, "0.39.2"));
+  findings.push(...await inspectIntegrationVersions(root, "0.43.2"));
   if (config.enforcement?.requireBriefingFirst !== false && stage !== "ci") {
     const hasBriefing = await hasRecentBriefingMarker(paths, sessionId);
     findings.push(hasBriefing ? { severity: "ok", code: "briefing-loaded", message: "A recent Hivelore briefing marker exists." } : {
@@ -10819,7 +11062,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
     findings.push(...await verifyDecisionCoverage(paths, stage, sessionId));
   }
   if (stage === "pre-commit" || stage === "ci") {
-    findings.push(...await runPrecommitPolicy(paths, config.enforcement?.antiPatternGate ?? "anchored", stage));
+    findings.push(...await runPrecommitPolicy(paths, config.enforcement?.antiPatternGate ?? "anchored", stage, config));
   } else if (stage === "local") {
     findings.push({
       severity: "info",
@@ -11026,16 +11269,16 @@ async function verifyDecisionCoverage(paths, stage, sessionId) {
     impact: Math.min(35, 10 + missing.length * 5)
   }];
 }
-async function runPrecommitPolicy(paths, gate, stage) {
+async function runPrecommitPolicy(paths, gate, stage, config) {
   const snapshot = await getPolicyDiffSnapshot(paths.root, stage);
   const weakenings = detectSensorWeakening(snapshot.diff);
   const weakeningFindings = weakenings.length > 0 ? [{
-    severity: "warn",
+    severity: config.enforcement?.sensorWeakeningGate === "block" ? "error" : "warn",
     code: "sensor-weakened",
     message: `This diff weakens the enforcement surface \u2014 ${weakenings.length} sensor change(s) need review: ` + weakenings.slice(0, 5).map((w) => `${w.memory_id} (${w.change}: ${w.detail})`).join(", ") + (weakenings.length > 5 ? ", \u2026" : "") + ".",
     fix: "If the demotion/removal is intentional, say so in the commit message; otherwise restore the sensor (`hivelore sensors list` shows the current state).",
     memory_ids: [...new Set(weakenings.map((w) => w.memory_id))].slice(0, 10),
-    impact: 8
+    impact: config.enforcement?.sensorWeakeningGate === "block" ? 30 : 8
   }] : [];
   if (gate === "off") {
     return [
@@ -11122,6 +11365,17 @@ async function runPrecommitPolicy(paths, gate, stage) {
     ...weakeningFindings
   ];
 }
+async function stagedFileContent(root, rel) {
+  try {
+    return await runCommand2("git", ["show", `:${rel}`], root);
+  } catch {
+    try {
+      return await readFile18(path40.resolve(root, rel), "utf8");
+    } catch {
+      return null;
+    }
+  }
+}
 async function runSensorGate(paths, diff, stage) {
   if (!diff || !existsSync42(paths.memoriesDir)) return [];
   try {
@@ -11174,7 +11428,78 @@ async function runSensorGate(paths, diff, stage) {
         });
       }
     }
-    const config = await loadConfig12(paths).catch(() => null);
+    const astSensorMemories = scannable.filter((m) => m.frontmatter.sensor.kind === "ast");
+    if (astSensorMemories.length > 0) {
+      const addedByPath = addedLineNumbersFromDiff(diff);
+      if (!await astEngineAvailable()) {
+        findings.push({
+          severity: "warn",
+          code: "ast-sensor-unrunnable",
+          message: `${astSensorMemories.length} AST sensor(s) could not run \u2014 the optional @ast-grep/napi engine is not installed. Their protection is OFF on this machine.`,
+          fix: "Install the engine: `npm i -g @ast-grep/napi` (or add it to the repo devDependencies).",
+          impact: 5
+        });
+      } else {
+        for (const memory2 of astSensorMemories) {
+          const sensor = memory2.frontmatter.sensor;
+          if (!sensor.pattern && !sensor.rule) continue;
+          const applicable = targets.filter((t) => sensorAppliesToPath2(sensor, memory2.frontmatter.anchor.paths, t.path));
+          if (applicable.length === 0) continue;
+          let fired = false;
+          for (const target of applicable) {
+            const added = addedByPath.get(target.path);
+            if (!added || added.size === 0) continue;
+            const content = await stagedFileContent(paths.root, target.path);
+            if (content === null) continue;
+            const scan = await runAstSensorOnContent({
+              pattern: sensor.pattern,
+              rule: sensor.rule,
+              language: sensor.language,
+              absent: sensor.absent,
+              content,
+              filePath: target.path,
+              addedLines: added
+            });
+            if (scan.status !== "ok" || scan.matches.length === 0) continue;
+            fired = true;
+            if (seen.has(memory2.frontmatter.id)) break;
+            seen.add(memory2.frontmatter.id);
+            firedIds.add(memory2.frontmatter.id);
+            const where = ` (${target.path}:${scan.matches[0].startLine})`;
+            if (sensor.severity === "block") {
+              findings.push({
+                severity: "error",
+                code: "sensor-block",
+                message: `Block AST sensor fired \u2014 ${memory2.frontmatter.id}: ${sensor.message}${where}${incidentSuffix(sensor.incident)}
+  matched: ${scan.matches[0].text}`,
+                fix: "Remove the flagged construct, or run `hivelore sensors check` to inspect the match.",
+                impact: 45,
+                memory_ids: [memory2.frontmatter.id]
+              });
+            } else {
+              findings.push({
+                severity: "warn",
+                code: "sensor-warn",
+                message: `AST sensor flagged ${memory2.frontmatter.id}: ${sensor.message}${where}${incidentSuffix(sensor.incident)}`,
+                fix: "Review the flagged construct; `hivelore sensors check` shows the matched code.",
+                impact: 5,
+                memory_ids: [memory2.frontmatter.id]
+              });
+            }
+            break;
+          }
+          ledgerRows.push(evaluation({
+            memory_id: memory2.frontmatter.id,
+            kind: "ast",
+            stage,
+            head_sha: headSha,
+            scope_hash: "",
+            outcome: fired ? "fired" : "silent"
+          }));
+        }
+      }
+    }
+    const config = await loadConfig12(paths).catch(() => ({}));
     if (config?.enforcement?.runCommandSensors === true) {
       const changedPaths = targets.map((t) => t.path).filter(Boolean);
       const specs = selectCommandSensors(scannable, changedPaths).filter((sp) => !seen.has(sp.memory_id));
@@ -11212,13 +11537,14 @@ async function runSensorGate(paths, diff, stage) {
         if (run.status === "passed") continue;
         seen.add(run.memory_id);
         if (run.status === "unrunnable") {
+          const strictUnrunnable = config.enforcement?.commandSensorUnrunnable === "block";
           findings.push({
-            severity: "warn",
+            severity: strictUnrunnable ? "error" : "warn",
             code: "command-sensor-unrunnable",
             message: `Command sensor ${run.memory_id} could not run (${run.unrunnable_reason}): \`${run.command}\`` + (run.output_tail ? `
 ${run.output_tail}` : ""),
             fix: "Fix the sensor's command (or its timeout_ms), or demote it: `hivelore sensors promote <id> --severity warn`.",
-            impact: 5
+            impact: strictUnrunnable ? 35 : 5
           });
           continue;
         }
@@ -12303,6 +12629,7 @@ import {
   recordPreventionHits as recordPreventionHits2,
   resolveHaivePaths as resolveHaivePaths36,
   runSensors as runSensors2,
+  addedLineNumbersFromDiff as addedLineNumbersFromDiff2,
   buildProposeCommand,
   scaffoldPostIncidentTest,
   selectCommandSensors as selectCommandSensors2,
@@ -12340,6 +12667,7 @@ function registerSensors(program2) {
       );
       if ("absent" in row && row.absent) console.log(`     ${ui.dim("only when missing:")} ${row.absent}`);
       if (row.paths.length > 0) console.log(`     ${ui.dim("paths:")} ${row.paths.join(", ")}`);
+      if (row.red_proven) console.log(`     ${ui.green("\u2713 RED-proven")}${row.incident ? ` \u2014 ${row.incident}` : ""}`);
       if (row.last_fired) console.log(`     ${ui.dim("last fired:")} ${row.last_fired}`);
       if (brittle) console.log(`     ${ui.yellow("\u26A0 brittle:")} ${brittle} \u2014 consider rewriting or retiring this sensor`);
     }
@@ -12353,6 +12681,57 @@ function registerSensors(program2) {
     const diff = opts.diffFile ? await readFile20(path42.resolve(root, opts.diffFile), "utf8") : await stagedDiff(root);
     const targets = scannableSensorTargets(diff);
     const hits = runSensors2(memories, targets);
+    const astMemories = (await runnableSensorMemories(paths, false)).filter(
+      (m) => m.frontmatter.sensor?.kind === "ast" && m.frontmatter.sensor.pattern
+    );
+    const astHits = [];
+    let astUnrunnable = 0;
+    if (astMemories.length > 0) {
+      if (!await astEngineAvailable()) {
+        astUnrunnable = astMemories.length;
+      } else {
+        const addedByPath = addedLineNumbersFromDiff2(diff);
+        for (const memory2 of astMemories) {
+          const sensor = memory2.frontmatter.sensor;
+          for (const target of targets) {
+            if (!sensorAppliesToPath3(sensor, memory2.frontmatter.anchor.paths, target.path)) continue;
+            const added = addedByPath.get(target.path);
+            if (!added || added.size === 0) continue;
+            let content = null;
+            try {
+              content = (await exec5("git", ["show", `:${target.path}`], { cwd: root })).stdout;
+            } catch {
+              try {
+                content = await readFile20(path42.resolve(root, target.path), "utf8");
+              } catch {
+                content = null;
+              }
+            }
+            if (content === null) continue;
+            const scan = await runAstSensorOnContent({
+              pattern: sensor.pattern,
+              rule: sensor.rule,
+              language: sensor.language,
+              absent: sensor.absent,
+              content,
+              filePath: target.path,
+              addedLines: added
+            });
+            if (scan.status === "ok" && scan.matches.length > 0) {
+              astHits.push({
+                memory_id: memory2.frontmatter.id,
+                sensor,
+                file: target.path,
+                matched_line: `${target.path}:${scan.matches[0].startLine}  ${scan.matches[0].text}`,
+                message: sensor.message,
+                severity: sensor.severity
+              });
+              break;
+            }
+          }
+        }
+      }
+    }
     const config = await loadConfig13(paths);
     const runCommands = opts.commands || config.enforcement?.runCommandSensors === true;
     const changedPaths = targets.map((t) => t.path).filter(Boolean);
@@ -12414,9 +12793,10 @@ function registerSensors(program2) {
       for (const spec of commandSpecs) commandSkipped.push(spec.memory_id);
     }
     await appendSensorEvaluations2(paths, ledgerRows);
-    const firedIds = [...new Set([...hits, ...commandHits].map((hit) => hit.memory_id))];
+    const firedIds = [...new Set([...hits, ...astHits, ...commandHits].map((hit) => hit.memory_id))];
     const preventionDetails = Object.fromEntries([
       ...hits.map((hit) => [hit.memory_id, { kind: "regex", stage: "manual" }]),
+      ...astHits.map((hit) => [hit.memory_id, { kind: "ast", stage: "manual" }]),
       ...commandHits.map((hit) => [hit.memory_id, {
         kind: commandSpecs.find((spec) => spec.memory_id === hit.memory_id)?.kind ?? "shell",
         stage: "manual",
@@ -12425,8 +12805,9 @@ function registerSensors(program2) {
     ]);
     await recordPreventionHits2(paths, firedIds, "sensor", /* @__PURE__ */ new Date(), preventionDetails);
     const output = {
-      scanned: memories.length,
-      hits: hits.map((hit) => ({
+      scanned: memories.length + astMemories.length,
+      ast_unrunnable: astUnrunnable,
+      hits: [...hits, ...astHits].map((hit) => ({
         memory_id: hit.memory_id,
         file: hit.file,
         severity: hit.severity,
@@ -12440,9 +12821,12 @@ function registerSensors(program2) {
     if (opts.json) {
       console.log(JSON.stringify(output, null, 2));
     } else {
-      const total = hits.length + commandHits.length;
-      console.log(ui.bold(`Hivelore sensors check \u2014 ${total} hit(s), ${memories.length} regex + ${commandSpecs.length} command sensor(s)`));
-      for (const hit of hits) {
+      const total = hits.length + astHits.length + commandHits.length;
+      console.log(ui.bold(`Hivelore sensors check \u2014 ${total} hit(s), ${memories.length} regex + ${astMemories.length} ast + ${commandSpecs.length} command sensor(s)`));
+      if (astUnrunnable > 0) {
+        console.log(ui.yellow(`  \u26A0 ${astUnrunnable} AST sensor(s) unrunnable \u2014 install @ast-grep/napi to activate them (never blocks).`));
+      }
+      for (const hit of [...hits, ...astHits]) {
         const marker = hit.severity === "block" ? ui.red("\u2717") : ui.yellow("\u26A0");
         console.log(`  ${marker} ${hit.memory_id} ${ui.dim(`(${hit.severity})`)}`);
         if (hit.file) console.log(`     ${ui.dim("file:")} ${hit.file}`);
@@ -12466,7 +12850,7 @@ function registerSensors(program2) {
         console.log(ui.dim(`  ${commandSkipped.length} command sensor(s) not run \u2014 pass --commands or set enforcement.runCommandSensors.`));
       }
     }
-    if ([...hits, ...commandHits].some((hit) => hit.severity === "block")) process.exitCode = 1;
+    if ([...hits, ...astHits, ...commandHits].some((hit) => hit.severity === "block")) process.exitCode = 1;
   });
   sensors.command("promote").description("Promote or demote an existing memory sensor severity").argument("<memory-id>", "memory id carrying the sensor").option("--severity <severity>", "block | warn", "block").option("--yes", "confirm promotion to block severity", false).option("--force", "promote even a brittle sensor (line-number/literal patterns) to block", false).option("-d, --dir <dir>", "project root").action(async (id, opts) => {
     const severity = opts.severity ?? "block";
@@ -12495,6 +12879,11 @@ function registerSensors(program2) {
       process.exitCode = 1;
       return;
     }
+    if (severity === "block" && (sensor.kind === "shell" || sensor.kind === "test") && sensor.red_proven !== true) {
+      ui.error("Refusing to promote an unproven command/test oracle to block. Re-propose it with --red-ref <pre-fix-commit>.");
+      process.exitCode = 1;
+      return;
+    }
     const brittle = sensor.kind === "regex" && sensor.pattern ? sensorPatternBrittleness2(sensor.pattern) : null;
     if (severity === "block" && brittle && !opts.force) {
       ui.error(`Refusing to block on a brittle sensor (${brittle}). Rewrite the pattern, or pass --force.`);
@@ -12541,34 +12930,54 @@ function registerSensors(program2) {
   });
   sensors.command("propose").description(
     "Propose a discriminating sensor for a memory \u2014 you write the pattern, Hivelore validates it before\n  trusting it to block. Mirrors the MCP `propose_sensor` tool (the agent-authored path).\n\n  A `block` proposal is accepted ONLY if it is not brittle, stays SILENT on the current code,\n  and FIRES on the bad example. Rejected proposals are not written \u2014 fix and re-run.\n\n  Example:\n    hivelore sensors propose <memory-id> \\\n      --pattern 'stripe\\.paymentIntents\\.create' --absent 'idempotencyKey' \\\n      --bad-example 'stripe.paymentIntents.create({ amount })'"
-  ).argument("<memory-id>", "memory id to attach the sensor to").option("--kind <kind>", "regex (default) | shell | test \u2014 command kinds route the team's own oracle to this lesson", "regex").option("--pattern <regex>", "kind=regex: regex matching the FAULTY usage").option("--command <cmd>", "kind=shell|test: command the gate runs when the diff touches the sensor's paths").option("--timeout <ms>", "kind=shell|test: max runtime in ms (default 120000)").option("--absent <regex>", "regex for the CORRECT-usage marker (makes it discriminate)").option("--bad-example <code>", "a snippet that SHOULD match (else examples are read from the lesson)").option("--severity <severity>", "block | warn", "block").option("--message <text>", "fix message shown when it fires").option("--incident <ref>", "provenance: the incident this sensor guards (e.g. 'prod #442') \u2014 shown when it fires and in the receipt").option("--flags <flags>", "regex flags (e.g. i)").option("--paths <csv>", "override scope paths (defaults to the memory anchors)").option("-d, --dir <dir>", "project root").action(async (id, opts) => {
-    if (opts.kind === "shell" || opts.kind === "test") {
-      if (!opts.command?.trim()) {
+  ).argument("<memory-id>", "memory id to attach the sensor to").option("--kind <kind>", "regex (default) | ast (structural \u2014 comments/strings can't false-positive) | shell | test (route the team's own oracle)", "regex").option("--pattern <regex>", "kind=regex: regex matching the FAULTY usage").option("--rule <json>", "kind=ast: full ast-grep Rule JSON (kind/inside/has/not/all/any)").option("--language <name>", "kind=ast: explicit language for non-standard extensions").option("--command <cmd>", "kind=shell|test: command the gate runs when the diff touches the sensor's paths").option("--timeout <ms>", "kind=shell|test: max runtime in ms (default 120000)").option("--absent <regex>", "regex for the CORRECT-usage marker (makes it discriminate)").option("--bad-example <code>", "a snippet that SHOULD match (else examples are read from the lesson)").option("--severity <severity>", "block | warn", "block").option("--message <text>", "fix message shown when it fires").option("--incident <ref>", "provenance: the incident this sensor guards (e.g. 'prod #442') \u2014 shown when it fires and in the receipt").option("--red-ref <ref>", "kind=shell|test: pre-fix commit/ref \u2014 validation replays it in a scratch worktree and requires the oracle to FAIL there (records red_proven)").option("--flags <flags>", "regex flags (e.g. i)").option("--paths <csv>", "override scope paths (defaults to the memory anchors)").option("-d, --dir <dir>", "project root").action(async (id, opts) => {
+    if (opts.kind === "shell" || opts.kind === "test" || opts.kind === "ast") {
+      if ((opts.kind === "shell" || opts.kind === "test") && !opts.command?.trim()) {
         ui.error("--kind shell|test requires --command.");
         process.exitCode = 1;
         return;
       }
+      if (opts.kind === "ast" && !opts.pattern?.trim() && !opts.rule?.trim()) {
+        ui.error("--kind ast requires --pattern or --rule <json>.");
+        process.exitCode = 1;
+        return;
+      }
+      let astRule;
+      if (opts.rule?.trim()) {
+        try {
+          const parsed = JSON.parse(opts.rule);
+          if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("rule must be a JSON object");
+          astRule = parsed;
+        } catch (err) {
+          ui.error(`--rule must be valid ast-grep Rule JSON: ${err instanceof Error ? err.message : String(err)}`);
+          process.exitCode = 1;
+          return;
+        }
+      }
       const root2 = findProjectRoot39(opts.dir);
-      const { proposeSensor } = await import("./server-G6N6NJ64.js");
+      const { proposeSensor } = await import("./server-WW6JHBYY.js");
       const out = await proposeSensor(
         {
           memory_id: id,
           kind: opts.kind,
-          pattern: void 0,
-          command: opts.command.trim(),
+          pattern: opts.kind === "ast" ? opts.pattern?.trim() : void 0,
+          rule: astRule,
+          language: opts.kind === "ast" ? opts.language : void 0,
+          command: opts.command?.trim(),
           timeout_ms: opts.timeout ? Math.max(1, Number(opts.timeout)) : void 0,
-          absent: void 0,
-          bad_example: void 0,
+          absent: opts.kind === "ast" ? opts.absent : void 0,
+          bad_example: opts.kind === "ast" ? opts.badExample : void 0,
           severity: opts.severity === "warn" ? "warn" : "block",
           message: opts.message,
           incident: opts.incident,
+          red_ref: opts.redRef,
           flags: void 0,
           paths: opts.paths ? opts.paths.split(",").map((p) => p.trim()).filter(Boolean) : []
         },
         { paths: resolveHaivePaths36(root2) }
       );
       if (out.accepted) {
-        ui.success(`Command sensor accepted (${out.severity}) on ${id}`);
+        ui.success(`${opts.kind === "ast" ? "AST" : "Command"} sensor accepted (${out.severity}) on ${id}`);
         ui.info(`  ${out.guidance}`);
       } else {
         ui.error(`Rejected (${out.reason}).`);
@@ -12748,10 +13157,14 @@ async function sensorRows(paths) {
       kind: sensor.kind,
       severity: sensor.severity,
       pattern: sensor.pattern,
+      rule: sensor.rule,
+      language: sensor.language,
       absent: sensor.absent,
       command: sensor.command,
       paths: sensor.paths.length > 0 ? sensor.paths : memory2.frontmatter.anchor.paths,
       message: sensor.message,
+      incident: sensor.incident,
+      red_proven: sensor.red_proven === true,
       autogen: sensor.autogen,
       last_fired: sensor.last_fired,
       ...brittle ? { brittle } : {}
@@ -12806,22 +13219,25 @@ import { mkdir as mkdir18, readFile as readFile21, writeFile as writeFile28 } fr
 import path43 from "path";
 import "commander";
 import {
+  appendProposedRetrievalCases as appendProposedRetrievalCases2,
   draftsFromFindings,
   filterNewDrafts,
   findProjectRoot as findProjectRoot40,
   loadMemoriesFromDir as loadMemoriesFromDir17,
   memoryFilePath as memoryFilePath7,
+  extractReviewLearnings,
   parseFindings,
   resolveHaivePaths as resolveHaivePaths37,
+  reviewLearningsToDrafts,
   serializeMemory as serializeMemory16
 } from "@hivelore/core";
 var SEVERITIES = ["info", "minor", "major", "critical", "blocker"];
 function registerIngest(program2) {
   program2.command("ingest").description(
-    "Ingest scanner findings (SonarQube / SARIF) as proposed, anchored memories with sensors.\n\n  Closes the review\u2194memory loop: a real defect a scanner found becomes a `gotcha`/`convention`\n  memory anchored to the file, pre-filled with a conservative `warn` sensor, so the next agent\n  is steered away from it. Drafts are status=proposed; a human validates/promotes them.\n\n  `sonar-api` fetches issues live over plain HTTPS from any SonarQube/SonarCloud instance \u2014\n  no MCP or special setup required, just a URL + token you provide (or SONAR_HOST_URL /\n  SONAR_TOKEN env). If you don't use it, file-based ingest works exactly the same.\n\n  Example:\n    hivelore ingest --from eslint eslint-report.json --min-severity major\n    hivelore ingest --from npm-audit audit.json --scope team\n    hivelore ingest --from sarif report.sarif --dry-run\n    hivelore ingest --from sonar sonar-issues.json --scope team --min-severity major\n    hivelore ingest --from sonar-api --sonar-component my_project --min-severity major\n\n  Generate the input reports:\n    eslint -f json -o eslint-report.json .      # --from eslint\n    npm audit --json > audit.json               # --from npm-audit\n"
-  ).argument("[file]", "path to the findings report JSON (required for --from sarif|sonar|eslint|npm-audit)").requiredOption("--from <format>", "report format: sarif | sonar | sonar-api | eslint | npm-audit").option("--dry-run", "show what would be created without writing", false).option("--scope <scope>", "memory scope: personal | team | module", "team").option("--module <name>", "module name (required when scope=module)").option("--type <type>", "memory type: gotcha | convention", "gotcha").option("--min-severity <severity>", "ignore findings below this severity (info|minor|major|critical|blocker)").option("--include-stylistic", "also ingest auto-fixable stylistic rules (semi/quotes/prefer-const\u2026); off by default as low-value noise", false).option("--limit <n>", "cap the number of memories created").option("--author <author>", "author email or handle").option("--json", "emit JSON", false).option("--sonar-url <url>", "SonarQube base URL for --from sonar-api (or env SONAR_HOST_URL)").option("--sonar-token <token>", "SonarQube token for --from sonar-api (or env SONAR_TOKEN)").option("--sonar-component <key>", "SonarQube project/component key for --from sonar-api").option("--sonar-branch <branch>", "optional SonarQube branch for --from sonar-api").option("-d, --dir <dir>", "project root").action(async (file, opts) => {
+    "Ingest scanner findings (SonarQube / SARIF) as proposed, anchored memories with sensors.\n\n  Closes the review\u2194memory loop: a real defect a scanner found becomes a `gotcha`/`convention`\n  memory anchored to the file, pre-filled with a conservative `warn` sensor, so the next agent\n  is steered away from it. Drafts are status=proposed; a human validates/promotes them.\n\n  `sonar-api` fetches issues live over plain HTTPS from any SonarQube/SonarCloud instance \u2014\n  no MCP or special setup required, just a URL + token you provide (or SONAR_HOST_URL /\n  SONAR_TOKEN env). If you don't use it, file-based ingest works exactly the same.\n\n  Example:\n    hivelore ingest --from eslint eslint-report.json --min-severity major\n    hivelore ingest --from npm-audit audit.json --scope team\n    hivelore ingest --from sarif report.sarif --dry-run\n    hivelore ingest --from sonar sonar-issues.json --scope team --min-severity major\n    hivelore ingest --from sonar-api --sonar-component my_project --min-severity major\n\n  Generate the input reports:\n    eslint -f json -o eslint-report.json .      # --from eslint\n    npm audit --json > audit.json               # --from npm-audit\n\n  Review learnings (the PR loop \u2014 a reviewer reply becomes a proposed memory):\n    hivelore ingest --from github-pr 123          # fetches review threads via gh\n    hivelore ingest --from github-pr comments.json --dry-run\n    Kept: human replies that read as instructions (never/always/must/prefer\u2026) or carry\n    the explicit marker (reply `/hivelore remember <rule>` on the thread).\n"
+  ).argument("[file]", "findings report JSON \u2014 or, for --from github-pr, a PR number/URL (fetched via gh) or a recorded comments JSON").requiredOption("--from <format>", "report format: sarif | sonar | sonar-api | eslint | npm-audit | github-pr").option("--dry-run", "show what would be created without writing", false).option("--scope <scope>", "memory scope: personal | team | module", "team").option("--module <name>", "module name (required when scope=module)").option("--type <type>", "memory type: gotcha | convention", "gotcha").option("--min-severity <severity>", "ignore findings below this severity (info|minor|major|critical|blocker)").option("--include-stylistic", "also ingest auto-fixable stylistic rules (semi/quotes/prefer-const\u2026); off by default as low-value noise", false).option("--limit <n>", "cap the number of memories created").option("--author <author>", "author email or handle").option("--json", "emit JSON", false).option("--sonar-url <url>", "SonarQube base URL for --from sonar-api (or env SONAR_HOST_URL)").option("--sonar-token <token>", "SonarQube token for --from sonar-api (or env SONAR_TOKEN)").option("--sonar-component <key>", "SonarQube project/component key for --from sonar-api").option("--sonar-branch <branch>", "optional SonarQube branch for --from sonar-api").option("-d, --dir <dir>", "project root").action(async (file, opts) => {
     const format = opts.from;
-    const VALID_FORMATS = ["sarif", "sonar", "sonar-api", "eslint", "npm-audit"];
+    const VALID_FORMATS = ["sarif", "sonar", "sonar-api", "eslint", "npm-audit", "github-pr"];
     if (!format || !VALID_FORMATS.includes(format)) {
       ui.error(`--from must be one of: ${VALID_FORMATS.join(", ")}`);
       process.exitCode = 1;
@@ -12846,7 +13262,25 @@ function registerIngest(program2) {
     }
     const parseFormat = format === "sonar-api" ? "sonar" : format;
     let raw;
-    if (format === "sonar-api") {
+    if (format === "github-pr") {
+      if (!file) {
+        ui.error("--from github-pr needs a PR number/URL or a recorded comments JSON file.");
+        process.exitCode = 1;
+        return;
+      }
+      const asPath = path43.resolve(root, file);
+      if (existsSync45(asPath)) {
+        raw = await readFile21(asPath, "utf8");
+      } else {
+        const fetched = await fetchPrReviewComments(root, file);
+        if (!fetched.ok) {
+          ui.error(fetched.error);
+          process.exitCode = 1;
+          return;
+        }
+        raw = fetched.json;
+      }
+    } else if (format === "sonar-api") {
       const fetched = await fetchSonarIssues(opts);
       if (!fetched.ok) {
         ui.error(fetched.error);
@@ -12876,7 +13310,23 @@ function registerIngest(program2) {
     }
     let drafts;
     let findingsCount = 0;
-    try {
+    if (format === "github-pr") {
+      try {
+        const payload = JSON.parse(raw);
+        findingsCount = Array.isArray(payload) ? payload.length : 0;
+        const learnings = extractReviewLearnings(payload);
+        drafts = reviewLearningsToDrafts(learnings, {
+          scope: opts.scope ?? "team",
+          module: opts.module,
+          author: opts.author,
+          ...opts.limit ? { limit: Math.max(0, Number.parseInt(opts.limit, 10) || 0) } : {}
+        });
+      } catch (err) {
+        ui.error(`Failed to parse the PR comments payload: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
+        return;
+      }
+    } else try {
       const findings = parseFindings(parseFormat, raw, { cwd: root });
       findingsCount = findings.length;
       drafts = draftsFromFindings(findings, {
@@ -12903,6 +13353,7 @@ function registerIngest(program2) {
       const created2 = [];
       if (!opts.dryRun) {
         for (const draft of fresh) created2.push(await writeDraft(paths, draft));
+        if (format === "github-pr") await appendReviewGoldenCases(root, fresh);
       }
       console.log(
         JSON.stringify(
@@ -12955,6 +13406,7 @@ function registerIngest(program2) {
       await writeDraft(paths, draft);
       created++;
     }
+    if (format === "github-pr") await appendReviewGoldenCases(root, fresh);
     ui.success(`Created ${created} proposed memory(ies) under ${path43.relative(root, paths.memoriesDir)}/`);
     ui.info("Review with `hivelore memory pending`; promote sensors with `hivelore sensors promote <id> --yes`.");
   });
@@ -12965,6 +13417,19 @@ async function writeDraft(paths, draft) {
   await writeFile28(file, serializeMemory16({ frontmatter: draft.frontmatter, body: draft.body }), "utf8");
   return file;
 }
+async function appendReviewGoldenCases(root, drafts) {
+  if (drafts.length === 0) return;
+  const specFile = path43.join(root, ".ai", "eval", "spec.json");
+  const current = existsSync45(specFile) ? await readFile21(specFile, "utf8") : null;
+  const cases = drafts.map((draft) => ({
+    name: `review-learning:${draft.topic}`,
+    task: draft.finding.message,
+    ...draft.finding.path ? { files: [draft.finding.path] } : {},
+    expect_ids: [draft.frontmatter.id]
+  }));
+  await mkdir18(path43.dirname(specFile), { recursive: true });
+  await writeFile28(specFile, appendProposedRetrievalCases2(current, cases), "utf8");
+}
 async function fetchSonarIssues(opts) {
   const baseUrl = (opts.sonarUrl ?? process.env.SONAR_HOST_URL ?? "").trim().replace(/\/+$/, "");
   const token = (opts.sonarToken ?? process.env.SONAR_TOKEN ?? "").trim();
@@ -13001,6 +13466,42 @@ async function fetchSonarIssues(opts) {
     };
   }
 }
+async function fetchPrReviewComments(root, ref) {
+  const numberMatch = ref.match(/^(\d+)$/) ?? ref.match(/\/pull\/(\d+)/);
+  if (!numberMatch) {
+    return { ok: false, error: `"${ref}" is neither a comments JSON file, a PR number, nor a PR URL.` };
+  }
+  const prNumber = numberMatch[1];
+  const { execFile: execFile9 } = await import("child_process");
+  const { promisify: promisify9 } = await import("util");
+  const run = promisify9(execFile9);
+  try {
+    const fetchPages = async (endpoint) => {
+      const { stdout } = await run(
+        "gh",
+        ["api", endpoint, "--paginate", "--slurp"],
+        { cwd: root, maxBuffer: 16 * 1024 * 1024 }
+      );
+      const pages = JSON.parse(stdout);
+      return Array.isArray(pages) ? pages.flatMap((page) => Array.isArray(page) ? page : []) : [];
+    };
+    const [reviewComments, issueComments] = await Promise.all([
+      fetchPages(`repos/{owner}/{repo}/pulls/${prNumber}/comments`),
+      fetchPages(`repos/{owner}/{repo}/issues/${prNumber}/comments`)
+    ]);
+    const normalizedIssueComments = issueComments.map((row) => ({
+      ...row,
+      pull_request_url: `https://api.github.com/repos/{owner}/{repo}/pulls/${prNumber}`
+    }));
+    return { ok: true, json: JSON.stringify([...reviewComments, ...normalizedIssueComments]) };
+  } catch (err) {
+    const e = err;
+    return {
+      ok: false,
+      error: `Could not fetch PR #${prNumber} comments via gh: ${(e.stderr || e.message || String(err)).slice(0, 200)}. Install/authenticate the gh CLI, or pass a recorded comments JSON file instead.`
+    };
+  }
+}
 
 // src/commands/dashboard.ts
 import { existsSync as existsSync46 } from "fs";
@@ -13460,7 +13961,7 @@ function registerBridges(program2) {
 
 // src/index.ts
 var program = new Command48();
-program.name("hivelore").description("Hivelore - the deterministic policy gate for agent-written code (rules live as repo-native team memory)").version("0.39.2").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
+program.name("hivelore").description("Hivelore - the deterministic policy gate for agent-written code (rules live as repo-native team memory)").version("0.43.2").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
 registerInit(program);
 registerResolveProject(program);
 registerEnforce(program);