@hivelore/cli 0.42.1 → 0.43.2

package/dist/index.js

@@ -13,7 +13,7 @@ import {
   readPresumedCorrectTargets,
   runAstSensorOnContent,
   runHaiveMcpStdio
-} from "./chunk-EJ7A4IKD.js";
+} from "./chunk-FXDGOBPT.js";
 import {
   registerMemoryPending
 } from "./chunk-OYJKHD22.js";
@@ -3758,7 +3758,7 @@ ${SEED_FOOTER(stack)}` });
 
 // src/commands/init.ts
 var execFileAsync = promisify2(execFile2);
-var HAIVE_GITHUB_ACTION_REF = `v${"0.42.1"}`;
+var HAIVE_GITHUB_ACTION_REF = `v${"0.43.2"}`;
 var PROJECT_CONTEXT_TEMPLATE = `# Project context
 
 > Generated by \`hivelore init\`. Run \`hivelore init --bootstrap\` to auto-fill from your codebase,
@@ -7757,7 +7757,9 @@ function registerBenchmark(program2) {
       "   - Hivelore agents must run `hivelore briefing --files ... --task ...` first.",
       "   - Plain agents must not read `.ai` or call Hivelore.",
       "5. Require every agent to write `BENCHMARK_AGENT_REPORT.md`.",
+      "   Its `## Outcome` section must include: Task completed, Tests passed, Policy violations, Duration seconds, Total tokens.",
       "6. Run `hivelore benchmark report --dir <benchmark-root> --out RESULTS.md`.",
+      "7. Do not make comparative claims until evidence_grade=decision-ready (>=10 paired tasks with complete outcomes).",
       "",
       "Recommended metrics: pass rate, test iterations, files read, files changed, visible artifacts, decision quality, and token proxy."
     ].join("\n"));
@@ -7795,15 +7797,32 @@ function parseAgentReport(fixture, report) {
     terminal_failures: countMatches(section(report, "Terminal Errors"), /fail|error|not raised|exited with code 1/gi),
     decision_mentions: sectionBulletCount(report, "Key Decisions"),
     report_tokens_est: estimateTokens2(report),
-    haive_impact: /Hivelore Memory Impact[\s\S]*?\b(yes|directly|changed|shaped|confirmed)\b/i.test(report)
+    haive_impact: /Hivelore Memory Impact[\s\S]*?\b(yes|directly|changed|shaped|confirmed)\b/i.test(report),
+    task_completed: reportBoolean(report, "Task completed"),
+    tests_passed: reportBoolean(report, "Tests passed"),
+    policy_violations: reportNumber(report, "Policy violations"),
+    duration_seconds: reportNumber(report, "Duration seconds"),
+    total_tokens: reportNumber(report, "Total tokens")
   };
 }
 function summarizeRows(rows) {
   const byGroup = (group) => rows.filter((r) => r.group === group);
+  const haiveRows = byGroup("haive");
+  const plainRows = byGroup("plain");
+  const taskName = (fixture) => fixture.replace(/-(haive|plain)$/, "");
+  const plainTasks = new Set(plainRows.map((row) => taskName(row.fixture)));
+  const pairedTasks = new Set(haiveRows.map((row) => taskName(row.fixture)).filter((name) => plainTasks.has(name))).size;
+  const outcomeComplete = rows.length > 0 && rows.every(
+    (row) => row.task_completed !== null && row.tests_passed !== null && row.policy_violations !== null && row.duration_seconds !== null && row.total_tokens !== null
+  );
+  const decisionReady = pairedTasks >= 10 && outcomeComplete;
   return {
     fixtures: rows.length,
-    haive: summarizeGroup(byGroup("haive")),
-    plain: summarizeGroup(byGroup("plain"))
+    paired_tasks: pairedTasks,
+    evidence_grade: decisionReady ? "decision-ready" : "insufficient",
+    evidence_reason: decisionReady ? "At least 10 paired tasks with complete correctness, policy, duration, and token outcomes." : `Need >=10 paired tasks and complete Outcome fields; found ${pairedTasks} pair(s), outcome_complete=${outcomeComplete}.`,
+    haive: summarizeGroup(haiveRows),
+    plain: summarizeGroup(plainRows)
   };
 }
 function summarizeGroup(rows) {
@@ -7817,7 +7836,12 @@ function summarizeGroup(rows) {
     terminal_failures: sum("terminal_failures"),
     decision_mentions: sum("decision_mentions"),
     report_tokens_est: sum("report_tokens_est"),
-    haive_impact_count: rows.filter((r) => r.haive_impact).length
+    haive_impact_count: rows.filter((r) => r.haive_impact).length,
+    completed: rows.filter((r) => r.task_completed === true).length,
+    tests_passed: rows.filter((r) => r.tests_passed === true).length,
+    policy_violations: rows.reduce((total, row) => total + (row.policy_violations ?? 0), 0),
+    duration_seconds: rows.reduce((total, row) => total + (row.duration_seconds ?? 0), 0),
+    total_tokens: rows.reduce((total, row) => total + (row.total_tokens ?? 0), 0)
   };
 }
 function renderMarkdown(root, summary, rows) {
@@ -7828,6 +7852,8 @@ function renderMarkdown(root, summary, rows) {
     "",
     "## Summary",
     "",
+    `Evidence grade: **${summary.evidence_grade}** \u2014 ${summary.evidence_reason}`,
+    "",
     "| Group | Fixtures | Commands | Files read | Files modified | Test iterations | Terminal failures | Decision mentions | Report tokens (est, report only) | Hivelore impact |",
     "| --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |",
     groupLine("Hivelore", summary.haive),
@@ -7851,6 +7877,23 @@ function renderMarkdown(root, summary, rows) {
   ];
   return lines.join("\n");
 }
+function reportValue(report, label) {
+  const match = new RegExp(`^[-*]\\s*${escapeRegExp(label)}\\s*:\\s*(.+)$`, "im").exec(report);
+  return match?.[1]?.trim() ?? null;
+}
+function reportBoolean(report, label) {
+  const value = reportValue(report, label);
+  if (!value) return null;
+  if (/^(yes|true|pass|passed|complete|completed)$/i.test(value)) return true;
+  if (/^(no|false|fail|failed|incomplete)$/i.test(value)) return false;
+  return null;
+}
+function reportNumber(report, label) {
+  const value = reportValue(report, label);
+  if (!value) return null;
+  const parsed = Number(value.replace(/,/g, ""));
+  return Number.isFinite(parsed) ? parsed : null;
+}
 function groupLine(label, group) {
   return `| ${label} | ${group.fixtures} | ${group.commands} | ${group.files_read} | ${group.files_modified} | ${group.test_iterations} | ${group.terminal_failures} | ${group.decision_mentions} | ${group.report_tokens_est} | ${group.haive_impact_count} |`;
 }
@@ -7978,6 +8021,8 @@ function registerEval(program2) {
     const authoredRetrievalCases = retrievalAgg ? retrievalAgg.cases.slice(resolvedSpec.synthesized) : [];
     const authoredRetrievalAgg = authoredRetrievalCases.length > 0 ? aggregateRetrieval(authoredRetrievalCases) : null;
     const authoredScore = resolvedSpec.authored > 0 && resolvedSpec.synthesized > 0 && (authoredRetrievalAgg || sensorAgg) ? overallScore(authoredRetrievalAgg, sensorAgg) : null;
+    const authoredReport = resolvedSpec.authored > 0 && (authoredRetrievalAgg || sensorAgg) ? buildReport(authoredRetrievalAgg, sensorAgg) : null;
+    const gateReport = authoredReport ?? report;
     const [usage, preventionEvents, config] = await Promise.all([
       loadUsageIndex13(paths),
       loadPreventionEvents3(paths),
@@ -8006,6 +8051,7 @@ function registerEval(program2) {
         k,
         spec_source: resolvedSpec.source,
         report,
+        ...authoredReport ? { authored_report: authoredReport } : {},
         gate_precision: gatePrecision
       };
       await mkdir13(path32.dirname(baselineFile), { recursive: true });
@@ -8025,7 +8071,7 @@ function registerEval(program2) {
         }
       } else {
         const snapshot = JSON.parse(await readFile15(baselineFile, "utf8"));
-        delta = compareEvalReports(snapshot.report, report);
+        delta = compareEvalReports(snapshot.authored_report ?? snapshot.report, gateReport);
         if (snapshot.gate_precision) {
           gateDelta = compareGatePrecision(snapshot.gate_precision, gatePrecision);
         }
@@ -8042,6 +8088,7 @@ function registerEval(program2) {
           ...authoredScore !== null ? { authored_score: authoredScore } : {}
         },
         report,
+        ...authoredReport ? { authored_report: authoredReport } : {},
         tier_contract: { checks: tierChecks, failures: tierFailures.length },
         proposed_golden_cases: proposedGoldenCount,
         gate_precision: gatePrecision,
@@ -8049,7 +8096,7 @@ function registerEval(program2) {
         ...gateDelta ? { gate_delta: gateDelta } : {}
       }, null, 2));
       if (tierFailures.length > 0) process.exitCode = 1;
-      applyExitGates(opts, report, delta, gatePrecision, gateDelta);
+      applyExitGates(opts, gateReport, delta, gatePrecision, gateDelta);
       return;
     }
     if (resolvedSpec.authored === 0 && resolvedSpec.synthesized > 0) {
@@ -8083,7 +8130,7 @@ function registerEval(program2) {
       console.log(md);
     }
     if (tierFailures.length > 0) process.exitCode = 1;
-    applyExitGates(opts, report, delta, gatePrecision, gateDelta);
+    applyExitGates(opts, gateReport, delta, gatePrecision, gateDelta);
   });
 }
 function parsePctThreshold(label, raw) {
@@ -8172,7 +8219,7 @@ async function resolveSpec(opts, root, memoriesDir) {
   if (existsSync35(defaultSpec)) {
     const raw = await readFile15(defaultSpec, "utf8");
     const explicit = JSON.parse(raw);
-    const memories2 = await loadMemoriesFromDir(memoriesDir);
+    const memories2 = (await loadMemoriesFromDir(memoriesDir)).filter(({ memory: memory2 }) => memory2.frontmatter.scope !== "personal");
     const synthesized2 = synthesizeSelfEvalCases(memories2, { includeFiles: !opts.semanticOnly });
     return {
       spec: {
@@ -8184,7 +8231,7 @@ async function resolveSpec(opts, root, memoriesDir) {
       authored: countCases(explicit)
     };
   }
-  const memories = await loadMemoriesFromDir(memoriesDir);
+  const memories = (await loadMemoriesFromDir(memoriesDir)).filter(({ memory: memory2 }) => memory2.frontmatter.scope !== "personal");
   const synthesized = synthesizeSelfEvalCases(memories, { includeFiles: !opts.semanticOnly });
   return {
     spec: { retrieval: synthesized },
@@ -8206,6 +8253,8 @@ async function runRetrieval(c, k, ctx) {
       semantic: true,
       include_stale: false,
       track: false,
+      memory_scopes: ["team", "module"],
+      deterministic: true,
       format: "compact",
       min_semantic_score: 0
     },
@@ -9026,9 +9075,35 @@ function registerDoctor(program2) {
         fix: "hivelore sensors list   # then `hivelore sensors promote <id>` for a trusted, non-brittle sensor \u2014 or retire the noise"
       });
     }
+    const commandSensorMemories = sensorMemories.filter((m) => {
+      const kind = m.memory.frontmatter.sensor?.kind;
+      return kind === "shell" || kind === "test";
+    });
+    if (commandSensorMemories.length > 0 && config.enforcement?.runCommandSensors !== true) {
+      findings.push({
+        severity: "error",
+        code: "command-sensors-disabled",
+        section: "Protection",
+        message: `${commandSensorMemories.length} command/test sensor(s) exist but enforcement.runCommandSensors is not true \u2014 their behaviour protection is OFF.`,
+        fix: "Set enforcement.runCommandSensors=true after reviewing the repo-authored commands."
+      });
+    }
+    const unprovenBlocks = commandSensorMemories.filter((m) => {
+      const sensor = m.memory.frontmatter.sensor;
+      return sensor.severity === "block" && sensor.red_proven !== true;
+    });
+    if (unprovenBlocks.length > 0) {
+      findings.push({
+        severity: "error",
+        code: "command-sensors-block-without-red",
+        section: "Protection",
+        message: `${unprovenBlocks.length} blocking command/test sensor(s) predate mandatory prove-RED and cannot substantiate their incident claim.`,
+        fix: "Re-propose each sensor with --red-ref <pre-fix-commit>, or demote it to warn."
+      });
+    }
     const astSensorCount = sensorMemories.filter((m) => m.memory.frontmatter.sensor?.kind === "ast").length;
     if (astSensorCount > 0) {
-      const { astEngineAvailable: astEngineAvailable2 } = await import("./server-PZWIQUU7.js");
+      const { astEngineAvailable: astEngineAvailable2 } = await import("./server-WW6JHBYY.js");
       if (!await astEngineAvailable2()) {
         findings.push({
           severity: "warn",
@@ -9198,7 +9273,7 @@ function registerDoctor(program2) {
         fix: "Edit .ai/haive.config.json: set autoSessionEnd: true (or re-run `hivelore init` without --manual)."
       });
     }
-    findings.push(...await collectInstallFindings(root, "0.42.1"));
+    findings.push(...await collectInstallFindings(root, "0.43.2"));
     findings.push(...await collectToolchainFindings(root));
     try {
       const legacyRaw = execSync("haive-mcp --version", {
@@ -9206,7 +9281,7 @@ function registerDoctor(program2) {
         timeout: 3e3,
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
-      const cliVersion = "0.42.1";
+      const cliVersion = "0.43.2";
       if (legacyRaw && legacyRaw !== cliVersion) {
         findings.push({
           severity: "warn",
@@ -10889,7 +10964,7 @@ async function checkBootstrapComplete(paths, config, productionCodeChanged) {
   }
   const memories = existsSync42(paths.memoriesDir) ? await loadMemoriesFromDir15(paths.memoriesDir) : [];
   const codeMap = await loadCodeMap7(paths);
-  const codeFiles = codeMap ? Object.keys(codeMap.files) : [];
+  const codeFiles = codeMap ? Object.keys(codeMap.files).filter((file) => existsSync42(path40.join(paths.root, file))) : [];
   let existingModules = [];
   try {
     const entries = await readdir4(paths.modulesContextDir, { withFileTypes: true });
@@ -10953,7 +11028,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
       findings: [{ severity: "info", code: "enforcement-off", message: "Hivelore enforcement is disabled." }]
     });
   }
-  findings.push(...await inspectIntegrationVersions(root, "0.42.1"));
+  findings.push(...await inspectIntegrationVersions(root, "0.43.2"));
   if (config.enforcement?.requireBriefingFirst !== false && stage !== "ci") {
     const hasBriefing = await hasRecentBriefingMarker(paths, sessionId);
     findings.push(hasBriefing ? { severity: "ok", code: "briefing-loaded", message: "A recent Hivelore briefing marker exists." } : {
@@ -10987,7 +11062,7 @@ async function buildEnforcementReport(dir, stage, sessionId) {
     findings.push(...await verifyDecisionCoverage(paths, stage, sessionId));
   }
   if (stage === "pre-commit" || stage === "ci") {
-    findings.push(...await runPrecommitPolicy(paths, config.enforcement?.antiPatternGate ?? "anchored", stage));
+    findings.push(...await runPrecommitPolicy(paths, config.enforcement?.antiPatternGate ?? "anchored", stage, config));
   } else if (stage === "local") {
     findings.push({
       severity: "info",
@@ -11194,16 +11269,16 @@ async function verifyDecisionCoverage(paths, stage, sessionId) {
     impact: Math.min(35, 10 + missing.length * 5)
   }];
 }
-async function runPrecommitPolicy(paths, gate, stage) {
+async function runPrecommitPolicy(paths, gate, stage, config) {
   const snapshot = await getPolicyDiffSnapshot(paths.root, stage);
   const weakenings = detectSensorWeakening(snapshot.diff);
   const weakeningFindings = weakenings.length > 0 ? [{
-    severity: "warn",
+    severity: config.enforcement?.sensorWeakeningGate === "block" ? "error" : "warn",
     code: "sensor-weakened",
     message: `This diff weakens the enforcement surface \u2014 ${weakenings.length} sensor change(s) need review: ` + weakenings.slice(0, 5).map((w) => `${w.memory_id} (${w.change}: ${w.detail})`).join(", ") + (weakenings.length > 5 ? ", \u2026" : "") + ".",
     fix: "If the demotion/removal is intentional, say so in the commit message; otherwise restore the sensor (`hivelore sensors list` shows the current state).",
     memory_ids: [...new Set(weakenings.map((w) => w.memory_id))].slice(0, 10),
-    impact: 8
+    impact: config.enforcement?.sensorWeakeningGate === "block" ? 30 : 8
   }] : [];
   if (gate === "off") {
     return [
@@ -11367,7 +11442,7 @@ async function runSensorGate(paths, diff, stage) {
       } else {
         for (const memory2 of astSensorMemories) {
           const sensor = memory2.frontmatter.sensor;
-          if (!sensor.pattern) continue;
+          if (!sensor.pattern && !sensor.rule) continue;
           const applicable = targets.filter((t) => sensorAppliesToPath2(sensor, memory2.frontmatter.anchor.paths, t.path));
           if (applicable.length === 0) continue;
           let fired = false;
@@ -11378,6 +11453,8 @@ async function runSensorGate(paths, diff, stage) {
             if (content === null) continue;
             const scan = await runAstSensorOnContent({
               pattern: sensor.pattern,
+              rule: sensor.rule,
+              language: sensor.language,
               absent: sensor.absent,
               content,
               filePath: target.path,
@@ -11422,7 +11499,7 @@ async function runSensorGate(paths, diff, stage) {
         }
       }
     }
-    const config = await loadConfig12(paths).catch(() => null);
+    const config = await loadConfig12(paths).catch(() => ({}));
     if (config?.enforcement?.runCommandSensors === true) {
       const changedPaths = targets.map((t) => t.path).filter(Boolean);
       const specs = selectCommandSensors(scannable, changedPaths).filter((sp) => !seen.has(sp.memory_id));
@@ -11460,13 +11537,14 @@ async function runSensorGate(paths, diff, stage) {
         if (run.status === "passed") continue;
         seen.add(run.memory_id);
         if (run.status === "unrunnable") {
+          const strictUnrunnable = config.enforcement?.commandSensorUnrunnable === "block";
           findings.push({
-            severity: "warn",
+            severity: strictUnrunnable ? "error" : "warn",
             code: "command-sensor-unrunnable",
             message: `Command sensor ${run.memory_id} could not run (${run.unrunnable_reason}): \`${run.command}\`` + (run.output_tail ? `
 ${run.output_tail}` : ""),
             fix: "Fix the sensor's command (or its timeout_ms), or demote it: `hivelore sensors promote <id> --severity warn`.",
-            impact: 5
+            impact: strictUnrunnable ? 35 : 5
           });
           continue;
         }
@@ -12589,6 +12667,7 @@ function registerSensors(program2) {
       );
       if ("absent" in row && row.absent) console.log(`     ${ui.dim("only when missing:")} ${row.absent}`);
       if (row.paths.length > 0) console.log(`     ${ui.dim("paths:")} ${row.paths.join(", ")}`);
+      if (row.red_proven) console.log(`     ${ui.green("\u2713 RED-proven")}${row.incident ? ` \u2014 ${row.incident}` : ""}`);
       if (row.last_fired) console.log(`     ${ui.dim("last fired:")} ${row.last_fired}`);
       if (brittle) console.log(`     ${ui.yellow("\u26A0 brittle:")} ${brittle} \u2014 consider rewriting or retiring this sensor`);
     }
@@ -12631,6 +12710,8 @@ function registerSensors(program2) {
             if (content === null) continue;
             const scan = await runAstSensorOnContent({
               pattern: sensor.pattern,
+              rule: sensor.rule,
+              language: sensor.language,
               absent: sensor.absent,
               content,
               filePath: target.path,
@@ -12798,6 +12879,11 @@ function registerSensors(program2) {
       process.exitCode = 1;
       return;
     }
+    if (severity === "block" && (sensor.kind === "shell" || sensor.kind === "test") && sensor.red_proven !== true) {
+      ui.error("Refusing to promote an unproven command/test oracle to block. Re-propose it with --red-ref <pre-fix-commit>.");
+      process.exitCode = 1;
+      return;
+    }
     const brittle = sensor.kind === "regex" && sensor.pattern ? sensorPatternBrittleness2(sensor.pattern) : null;
     if (severity === "block" && brittle && !opts.force) {
       ui.error(`Refusing to block on a brittle sensor (${brittle}). Rewrite the pattern, or pass --force.`);
@@ -12844,25 +12930,39 @@ function registerSensors(program2) {
   });
   sensors.command("propose").description(
     "Propose a discriminating sensor for a memory \u2014 you write the pattern, Hivelore validates it before\n  trusting it to block. Mirrors the MCP `propose_sensor` tool (the agent-authored path).\n\n  A `block` proposal is accepted ONLY if it is not brittle, stays SILENT on the current code,\n  and FIRES on the bad example. Rejected proposals are not written \u2014 fix and re-run.\n\n  Example:\n    hivelore sensors propose <memory-id> \\\n      --pattern 'stripe\\.paymentIntents\\.create' --absent 'idempotencyKey' \\\n      --bad-example 'stripe.paymentIntents.create({ amount })'"
-  ).argument("<memory-id>", "memory id to attach the sensor to").option("--kind <kind>", "regex (default) | ast (structural \u2014 comments/strings can't false-positive) | shell | test (route the team's own oracle)", "regex").option("--pattern <regex>", "kind=regex: regex matching the FAULTY usage").option("--command <cmd>", "kind=shell|test: command the gate runs when the diff touches the sensor's paths").option("--timeout <ms>", "kind=shell|test: max runtime in ms (default 120000)").option("--absent <regex>", "regex for the CORRECT-usage marker (makes it discriminate)").option("--bad-example <code>", "a snippet that SHOULD match (else examples are read from the lesson)").option("--severity <severity>", "block | warn", "block").option("--message <text>", "fix message shown when it fires").option("--incident <ref>", "provenance: the incident this sensor guards (e.g. 'prod #442') \u2014 shown when it fires and in the receipt").option("--red-ref <ref>", "kind=shell|test: pre-fix commit/ref \u2014 validation replays it in a scratch worktree and requires the oracle to FAIL there (records red_proven)").option("--flags <flags>", "regex flags (e.g. i)").option("--paths <csv>", "override scope paths (defaults to the memory anchors)").option("-d, --dir <dir>", "project root").action(async (id, opts) => {
+  ).argument("<memory-id>", "memory id to attach the sensor to").option("--kind <kind>", "regex (default) | ast (structural \u2014 comments/strings can't false-positive) | shell | test (route the team's own oracle)", "regex").option("--pattern <regex>", "kind=regex: regex matching the FAULTY usage").option("--rule <json>", "kind=ast: full ast-grep Rule JSON (kind/inside/has/not/all/any)").option("--language <name>", "kind=ast: explicit language for non-standard extensions").option("--command <cmd>", "kind=shell|test: command the gate runs when the diff touches the sensor's paths").option("--timeout <ms>", "kind=shell|test: max runtime in ms (default 120000)").option("--absent <regex>", "regex for the CORRECT-usage marker (makes it discriminate)").option("--bad-example <code>", "a snippet that SHOULD match (else examples are read from the lesson)").option("--severity <severity>", "block | warn", "block").option("--message <text>", "fix message shown when it fires").option("--incident <ref>", "provenance: the incident this sensor guards (e.g. 'prod #442') \u2014 shown when it fires and in the receipt").option("--red-ref <ref>", "kind=shell|test: pre-fix commit/ref \u2014 validation replays it in a scratch worktree and requires the oracle to FAIL there (records red_proven)").option("--flags <flags>", "regex flags (e.g. i)").option("--paths <csv>", "override scope paths (defaults to the memory anchors)").option("-d, --dir <dir>", "project root").action(async (id, opts) => {
     if (opts.kind === "shell" || opts.kind === "test" || opts.kind === "ast") {
       if ((opts.kind === "shell" || opts.kind === "test") && !opts.command?.trim()) {
         ui.error("--kind shell|test requires --command.");
         process.exitCode = 1;
         return;
       }
-      if (opts.kind === "ast" && !opts.pattern?.trim()) {
-        ui.error("--kind ast requires --pattern (an ast-grep structural pattern).");
+      if (opts.kind === "ast" && !opts.pattern?.trim() && !opts.rule?.trim()) {
+        ui.error("--kind ast requires --pattern or --rule <json>.");
         process.exitCode = 1;
         return;
       }
+      let astRule;
+      if (opts.rule?.trim()) {
+        try {
+          const parsed = JSON.parse(opts.rule);
+          if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("rule must be a JSON object");
+          astRule = parsed;
+        } catch (err) {
+          ui.error(`--rule must be valid ast-grep Rule JSON: ${err instanceof Error ? err.message : String(err)}`);
+          process.exitCode = 1;
+          return;
+        }
+      }
       const root2 = findProjectRoot39(opts.dir);
-      const { proposeSensor } = await import("./server-PZWIQUU7.js");
+      const { proposeSensor } = await import("./server-WW6JHBYY.js");
       const out = await proposeSensor(
         {
           memory_id: id,
           kind: opts.kind,
-          pattern: opts.kind === "ast" ? opts.pattern.trim() : void 0,
+          pattern: opts.kind === "ast" ? opts.pattern?.trim() : void 0,
+          rule: astRule,
+          language: opts.kind === "ast" ? opts.language : void 0,
           command: opts.command?.trim(),
           timeout_ms: opts.timeout ? Math.max(1, Number(opts.timeout)) : void 0,
           absent: opts.kind === "ast" ? opts.absent : void 0,
@@ -13057,10 +13157,14 @@ async function sensorRows(paths) {
       kind: sensor.kind,
       severity: sensor.severity,
       pattern: sensor.pattern,
+      rule: sensor.rule,
+      language: sensor.language,
       absent: sensor.absent,
       command: sensor.command,
       paths: sensor.paths.length > 0 ? sensor.paths : memory2.frontmatter.anchor.paths,
       message: sensor.message,
+      incident: sensor.incident,
+      red_proven: sensor.red_proven === true,
       autogen: sensor.autogen,
       last_fired: sensor.last_fired,
       ...brittle ? { brittle } : {}
@@ -13115,6 +13219,7 @@ import { mkdir as mkdir18, readFile as readFile21, writeFile as writeFile28 } fr
 import path43 from "path";
 import "commander";
 import {
+  appendProposedRetrievalCases as appendProposedRetrievalCases2,
   draftsFromFindings,
   filterNewDrafts,
   findProjectRoot as findProjectRoot40,
@@ -13248,6 +13353,7 @@ function registerIngest(program2) {
       const created2 = [];
       if (!opts.dryRun) {
         for (const draft of fresh) created2.push(await writeDraft(paths, draft));
+        if (format === "github-pr") await appendReviewGoldenCases(root, fresh);
       }
       console.log(
         JSON.stringify(
@@ -13300,6 +13406,7 @@ function registerIngest(program2) {
       await writeDraft(paths, draft);
       created++;
     }
+    if (format === "github-pr") await appendReviewGoldenCases(root, fresh);
     ui.success(`Created ${created} proposed memory(ies) under ${path43.relative(root, paths.memoriesDir)}/`);
     ui.info("Review with `hivelore memory pending`; promote sensors with `hivelore sensors promote <id> --yes`.");
   });
@@ -13310,6 +13417,19 @@ async function writeDraft(paths, draft) {
   await writeFile28(file, serializeMemory16({ frontmatter: draft.frontmatter, body: draft.body }), "utf8");
   return file;
 }
+async function appendReviewGoldenCases(root, drafts) {
+  if (drafts.length === 0) return;
+  const specFile = path43.join(root, ".ai", "eval", "spec.json");
+  const current = existsSync45(specFile) ? await readFile21(specFile, "utf8") : null;
+  const cases = drafts.map((draft) => ({
+    name: `review-learning:${draft.topic}`,
+    task: draft.finding.message,
+    ...draft.finding.path ? { files: [draft.finding.path] } : {},
+    expect_ids: [draft.frontmatter.id]
+  }));
+  await mkdir18(path43.dirname(specFile), { recursive: true });
+  await writeFile28(specFile, appendProposedRetrievalCases2(current, cases), "utf8");
+}
 async function fetchSonarIssues(opts) {
   const baseUrl = (opts.sonarUrl ?? process.env.SONAR_HOST_URL ?? "").trim().replace(/\/+$/, "");
   const token = (opts.sonarToken ?? process.env.SONAR_TOKEN ?? "").trim();
@@ -13356,17 +13476,29 @@ async function fetchPrReviewComments(root, ref) {
   const { promisify: promisify9 } = await import("util");
   const run = promisify9(execFile9);
   try {
-    const { stdout } = await run(
-      "gh",
-      ["api", `repos/{owner}/{repo}/pulls/${prNumber}/comments`, "--paginate"],
-      { cwd: root, maxBuffer: 16 * 1024 * 1024 }
-    );
-    return { ok: true, json: stdout };
+    const fetchPages = async (endpoint) => {
+      const { stdout } = await run(
+        "gh",
+        ["api", endpoint, "--paginate", "--slurp"],
+        { cwd: root, maxBuffer: 16 * 1024 * 1024 }
+      );
+      const pages = JSON.parse(stdout);
+      return Array.isArray(pages) ? pages.flatMap((page) => Array.isArray(page) ? page : []) : [];
+    };
+    const [reviewComments, issueComments] = await Promise.all([
+      fetchPages(`repos/{owner}/{repo}/pulls/${prNumber}/comments`),
+      fetchPages(`repos/{owner}/{repo}/issues/${prNumber}/comments`)
+    ]);
+    const normalizedIssueComments = issueComments.map((row) => ({
+      ...row,
+      pull_request_url: `https://api.github.com/repos/{owner}/{repo}/pulls/${prNumber}`
+    }));
+    return { ok: true, json: JSON.stringify([...reviewComments, ...normalizedIssueComments]) };
   } catch (err) {
     const e = err;
     return {
       ok: false,
-      error: `Could not fetch PR #${prNumber} review comments via gh: ${(e.stderr || e.message || String(err)).slice(0, 200)}. Install/authenticate the gh CLI, or pass a recorded comments JSON file instead.`
+      error: `Could not fetch PR #${prNumber} comments via gh: ${(e.stderr || e.message || String(err)).slice(0, 200)}. Install/authenticate the gh CLI, or pass a recorded comments JSON file instead.`
     };
   }
 }
@@ -13829,7 +13961,7 @@ function registerBridges(program2) {
 
 // src/index.ts
 var program = new Command48();
-program.name("hivelore").description("Hivelore - the deterministic policy gate for agent-written code (rules live as repo-native team memory)").version("0.42.1").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
+program.name("hivelore").description("Hivelore - the deterministic policy gate for agent-written code (rules live as repo-native team memory)").version("0.43.2").option("--advanced", "show maintenance and experimental commands in help").showSuggestionAfterError(true);
 registerInit(program);
 registerResolveProject(program);
 registerEnforce(program);