@lorekit/cli 1.33.4 → 1.34.0

package/README.md

@@ -381,7 +381,10 @@ lorekit lint --json           # { total, offline, remote } structured findings
 
 Rules: **empty-value** (blank/whitespace-only body), **short-value** (a non-empty
 body below a small length threshold), **untrimmed-value** (real content with
-surrounding whitespace), **empty-key** (blank key), and **malformed-scope** (e.g.
+surrounding whitespace), **empty-key** (blank key), **volatile-key** (the key
+carries a per-sighting identifier — a run of 6+ digits such as a GitHub comment
+id, or a `pr<n>` / `issue<n>` segment — so it never collides, never dedups, and
+freezes `seen_count` at 1), and **malformed-scope** (e.g.
 a single `:` where `::` is expected). `lint` **exits non-zero (1) when any issue
 is found**, so it is usable as a CI gate (`lorekit lint || exit 1`); a clean run —
 or one where only a store is unavailable — exits 0. The pure rule predicates live

package/bin/lorekit.mjs

@@ -78,8 +78,9 @@ ${c.bold('Commands')}
     (resolve) hierarchy and mark, per key, which scope's memory WINS and which are
               shadowed — the real hook-resolution order. --json, --scope <s>.
   lint        Flag low-quality memories (empty/short/untrimmed value, empty key,
-              malformed scope) across the applicable scopes and both stores. Exits
-              non-zero when issues are found (CI gate). --json, --scope <s>.
+              volatile key, malformed scope) across the applicable scopes and
+              both stores. Exits non-zero when issues are found (CI gate).
+              --json, --scope <s>.
   dedupe      Find likely-duplicate memories via a zero-dep word-overlap HEURISTIC
               (Jaccard >= threshold, not semantic), grouped into clusters per
               store. --json, --scope <s>, --threshold <0..1>.
@@ -495,10 +496,12 @@ ${c.bold('Usage')}
 
 Checks every memory for the current directory's scopes (project/branch/repo/
 global), across both stores, against a small set of quality rules: empty or
-whitespace-only value, suspiciously short value, untrimmed value, empty key, and
-malformed scope (e.g. a single \`:\` where \`::\` is expected). Each finding names
-the rule it violated. Exits NON-ZERO when any issue is found, so it works as a CI
-gate; a clean run — or one where only a store is unavailable — exits 0.
+whitespace-only value, suspiciously short value, untrimmed value, empty key, a
+volatile per-sighting identifier in the key (a run of 6+ digits, or a \`pr<n>\` /
+\`issue<n>\` reference), and malformed scope (e.g. a single \`:\` where \`::\` is
+expected). Each finding names the rule it violated. Exits NON-ZERO when any issue
+is found, so it works as a CI gate; a clean run — or one where only a store is
+unavailable — exits 0.
 
 ${c.bold('Options')}
   -d, --dir <path>        Target project root (default: current directory)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lorekit/cli",
-  "version": "1.33.4",
+  "version": "1.34.0",
   "description": "Install the LoreKit shared-memory skill and run health checks for the LoreKit MCP server.",
   "license": "MIT",
   "repository": {

package/skill/lorekit-groom/SKILL.md

@@ -89,8 +89,8 @@ The short version is six phases; the first four are pure analysis.
    `lorekit scopes` (store-wide inventory: every scope with its lesson count)
    show where the mass is. Pick the noisiest scope to start.
 2. **Lint** — `lorekit lint --json` flags structurally bad lessons (empty /
-   whitespace / suspiciously short / untrimmed values, empty keys, malformed
-   scopes). These are the cheapest wins: fix or drop them first.
+   whitespace / suspiciously short / untrimmed values, empty keys, volatile
+   keys, malformed scopes). These are the cheapest wins: fix or drop them first.
 3. **Dedupe** — `lorekit dedupe --json` clusters near-duplicate lessons. Start at
    a high `--threshold` (e.g. `0.85`) for confident duplicates, then lower it to
    surface looser paraphrases. Use `lorekit show <scope::key>` to read each

package/skill/lorekit-groom/rules/grooming-pass.md

@@ -38,6 +38,11 @@ Findings are structural, not semantic — each names its rule:
 - **empty-value / short-value / untrimmed-value** — the lesson carries little or
   no signal, or has stray leading/trailing whitespace.
 - **empty-key** — no key to address it by.
+- **volatile-key** — the key carries a per-sighting identifier (a run of 6+
+  digits such as a GitHub comment id, or a `pr<n>` / `issue<n>` segment), so it
+  never collides with a later write, never dedups, and leaves `seen_count`
+  frozen at 1. Re-key it onto the structural pattern and move the identifier
+  into the body.
 - **malformed-scope** — the scope string is invalid.
 
 These are the cheapest wins and the least controversial, so clear them first.

package/src/lessons-view.mjs

@@ -271,6 +271,41 @@ export const LINT_RULES = {
     return v.trim() && v !== v.trim() ? 'value has leading/trailing whitespace' : null;
   },
   'empty-key': (e) => (String(e.key ?? '').trim() ? null : 'key is empty or whitespace-only'),
+  // A key carrying a per-sighting identifier (a comment id, a PR/issue number) is
+  // unique forever, so it never collides, so the upsert never dedups it, so
+  // `seen_count` stays frozen at 1 and the memory can never reach a recurrence
+  // threshold — a write-only record. Detection is deliberately conservative:
+  //   • a run of 6+ digits (a GitHub comment id is ~10; `sha256`, `oauth2`,
+  //     `wcag22`, and semantic versions are all shorter runs);
+  //   • a `pr<n>` / `issue<n>` reference — the number joined by nothing, `-`, or
+  //     `_` — delimited by `:`, `-`, `_`, `/`, or a string boundary, so mid-word
+  //     digits (`oauth2`) never match.
+  // `volatileKeyAllow` is an embedder/test knob mirroring `short-value`'s
+  // `minValueLen` precedent — a list of substrings that exempt a key. There is
+  // no config key and no per-entry marker.
+  'volatile-key': (e, { volatileKeyAllow = [] } = {}) => {
+    const key = String(e.key ?? '');
+    if (!key.trim()) return null; // an empty key is `empty-key`'s to report.
+    // Tolerate a bare string as well as a list, so a caller passing
+    // `{ volatileKeyAllow: 'lorekit-231' }` does not silently iterate characters.
+    const allowList = Array.isArray(volatileKeyAllow) ? volatileKeyAllow : [volatileKeyAllow];
+    for (const allow of allowList) {
+      if (allow && key.includes(String(allow))) return null;
+    }
+    const digitRun = key.match(/\d{6,}/);
+    if (digitRun) {
+      return `key contains a volatile per-sighting identifier: '${digitRun[0]}' (a run of ${digitRun[0].length} digits)`;
+    }
+    // Boundary-anchored rather than split-then-match: splitting on `-` would
+    // separate `pr` from `231` and `pr-231` would slip through. The reference
+    // must start at a boundary (`:`, `-`, `_`, `/`, or the string start) and end
+    // at one, so `oauth2`/`sha256`/`wcag22` still never match.
+    const reference = key.match(/(?:^|[:\-_/])((?:pr|issue)[-_]?\d+)(?=$|[:\-_/])/i);
+    if (reference) {
+      return `key contains a volatile per-sighting identifier: '${reference[1]}' (a pr/issue number segment)`;
+    }
+    return null;
+  },
   'malformed-scope': (e) => {
     const reason = scopeIssue(e.scope);
     return reason ? `malformed scope: ${reason}` : null;

package/src/lint.mjs

@@ -1,8 +1,8 @@
 // `lorekit lint` — flag low-quality lessons across the applicable scopes and
 // both stores. Each finding names the rule it violated (empty/whitespace value,
-// suspiciously short value, untrimmed value, empty key, malformed scope). The
-// rules are pure predicates in `lessons-view.mjs` (`LINT_RULES` / `lintEntry`),
-// each independently unit-tested.
+// suspiciously short value, untrimmed value, empty key, volatile key, malformed
+// scope). The rules are pure predicates in `lessons-view.mjs` (`LINT_RULES` /
+// `lintEntry`), each independently unit-tested.
 //
 // Exit convention: `lint` exits NON-ZERO (1) when any finding exists, so it is
 // usable as a CI gate (`lorekit lint || fail`); a clean run — or a run where the