@massu/core 1.10.7 → 1.12.0

package/dist/detect/adapters/.bundle-shasums.json

@@ -1,12 +1,9 @@
 {
-  "@massu/core/adapter": "c6967280a498fc95b0f22a3e083a7dda509b5a3f5d249b94397c654e241dda2b",
+  "@massu/core/adapter": "37b40614a34247e7ca753f0fdc1db9ab646df7ce8f96684e8555fd4be032881b",
   "query-helpers": "f1372ef965450109258ad5bd300a1b3655660149e0b1b69ad30e1cc4acedcb2e",
   "parse-guard": "1bed6c2298b40c07f0bd9641d975bf00e4d656fb4f52ab42a28666390d47ec6d",
-  "tree-sitter-loader": "6e26e2c81385ce39f6edc2d7bc6537e4f3a048693a62e191ff9928ebfdddd14e",
+  "tree-sitter-loader": "90da8caa618a3fe21d4b8cd6c4e62f39a5cebd4c34b54ee7bd789a2bcee014a9",
   "types": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-  "rails": "a58db04f6f232a859f41714229b0680db3e2960213df9dab1ef95cd9d6670ede",
-  "phoenix": "3902e42393f4edbbe17c0058f9fc09c20b80ece1b08b56305cca6e9b972a8821",
-  "aspnet": "a04de27b4bf31c626375c376b613e2851d420a8c94494d9a222bd01c76f505ad",
-  "spring": "101ed8ab391b4769383dec6c1fee7429c2ee1f57efdb7d391f391d69e5dcbe1b",
-  "go-chi": "03be4cb66102ae172ec443f154ce18f0d5280e5e32cf408112539f06dad347c9"
+  "rails": "c9b1a0c19960d9e78a6ad57fce3fd05bfdd3ea3f862c76dd731c36bf8ef1f34b",
+  "spring": "5fb2f16d3aa733693b5090f2a972aab4818c23c850d15f6ef35c8e70a9884290"
 }

package/dist/detect/adapters/rails.js

@@ -258,8 +258,9 @@ function evictBeyondRetainCount(retain = getCacheRetainCount()) {
       continue;
     }
     if (stat.isSymbolicLink() || !stat.isFile()) {
-      console.error(
-        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).`
+      process.stderr.write(
+        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).
+`
       );
       continue;
     }
@@ -374,8 +375,9 @@ async function loadGrammar(language, options = {}) {
     }
     evictBeyondRetainCount();
   } catch (e) {
-    console.error(
-      `[tree-sitter-loader] cache write failed for ${language}: ${e instanceof Error ? e.message : String(e)} \u2014 loading directly from memory.`
+    process.stderr.write(
+      `[tree-sitter-loader] cache write failed for ${language}: ${e instanceof Error ? e.message : String(e)} \u2014 loading directly from memory.
+`
     );
   }
   const lang = await Language.load(body);

package/dist/detect/adapters/spring.js

@@ -258,8 +258,9 @@ function evictBeyondRetainCount(retain = getCacheRetainCount()) {
       continue;
     }
     if (stat.isSymbolicLink() || !stat.isFile()) {
-      console.error(
-        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).`
+      process.stderr.write(
+        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).
+`
       );
       continue;
     }
@@ -374,8 +375,9 @@ async function loadGrammar(language, options = {}) {
     }
     evictBeyondRetainCount();
   } catch (e) {
-    console.error(
-      `[tree-sitter-loader] cache write failed for ${language}: ${e instanceof Error ? e.message : String(e)} \u2014 loading directly from memory.`
+    process.stderr.write(
+      `[tree-sitter-loader] cache write failed for ${language}: ${e instanceof Error ? e.message : String(e)} \u2014 loading directly from memory.
+`
     );
   }
   const lang = await Language.load(body);

package/dist/detect/adapters/tree-sitter-loader.js

@@ -174,8 +174,9 @@ function evictBeyondRetainCount(retain = getCacheRetainCount()) {
       continue;
     }
     if (stat.isSymbolicLink() || !stat.isFile()) {
-      console.error(
-        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).`
+      process.stderr.write(
+        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).
+`
       );
       continue;
     }
@@ -293,8 +294,9 @@ async function loadGrammar(language, options = {}) {
     }
     evictBeyondRetainCount();
   } catch (e) {
-    console.error(
-      `[tree-sitter-loader] cache write failed for ${language}: ${e instanceof Error ? e.message : String(e)} \u2014 loading directly from memory.`
+    process.stderr.write(
+      `[tree-sitter-loader] cache write failed for ${language}: ${e instanceof Error ? e.message : String(e)} \u2014 loading directly from memory.
+`
     );
   }
   const lang = await Language.load(body);

package/dist/hooks/auto-learning-pipeline.js

@@ -341,6 +341,22 @@ var RawConfigSchema = z.object({
   accessScopes: z.array(z.string()).optional(),
   domains: z.array(DomainConfigSchema).default([]),
   rules: z.array(PatternRuleConfigSchema).default([]),
+  // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+  // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+  // used by pattern-scanner). At config-refresh time these entries are
+  // loaded into the `knowledge_rules` SQLite table with
+  // `source = 'customer-config'` so `massu_knowledge_rule` and the
+  // governance docs surface customer-defined rules alongside framework CRs.
+  governance_rules: z.array(
+    z.object({
+      id: z.string().min(1, "governance_rules[].id is required"),
+      title: z.string().min(1, "governance_rules[].title is required"),
+      description: z.string().min(1, "governance_rules[].description is required"),
+      vr_type: z.string().default("VR-CUSTOM"),
+      reference_path: z.string().optional(),
+      severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+    }).passthrough()
+  ).default([]),
   analytics: AnalyticsConfigSchema,
   governance: GovernanceConfigSchema,
   security: SecurityConfigSchema,
@@ -459,6 +475,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -489,6 +507,11 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
   return _config;
 }
 
+// src/hooks/lib/write-hook-message.ts
+function writeHookMessage(message) {
+  process.stdout.write(JSON.stringify({ message }) + "\n");
+}
+
 // src/hooks/auto-learning-pipeline.ts
 var MAX_FULL_DIFF_BYTES = 2 * 1024 * 1024;
 function getSessionFlagPath(sessionId) {
@@ -608,7 +631,7 @@ async function main() {
     lines.push("");
     lines.push("============================================================================");
     lines.push("");
-    console.log(lines.join("\n"));
+    writeHookMessage(lines.join("\n"));
     cleanup(flagPath);
   } catch {
   }

package/dist/hooks/classify-failure.js

@@ -348,6 +348,22 @@ var RawConfigSchema = z.object({
   accessScopes: z.array(z.string()).optional(),
   domains: z.array(DomainConfigSchema).default([]),
   rules: z.array(PatternRuleConfigSchema).default([]),
+  // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+  // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+  // used by pattern-scanner). At config-refresh time these entries are
+  // loaded into the `knowledge_rules` SQLite table with
+  // `source = 'customer-config'` so `massu_knowledge_rule` and the
+  // governance docs surface customer-defined rules alongside framework CRs.
+  governance_rules: z.array(
+    z.object({
+      id: z.string().min(1, "governance_rules[].id is required"),
+      title: z.string().min(1, "governance_rules[].title is required"),
+      description: z.string().min(1, "governance_rules[].description is required"),
+      vr_type: z.string().default("VR-CUSTOM"),
+      reference_path: z.string().optional(),
+      severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+    }).passthrough()
+  ).default([]),
   analytics: AnalyticsConfigSchema,
   governance: GovernanceConfigSchema,
   security: SecurityConfigSchema,
@@ -466,6 +482,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -1021,6 +1039,12 @@ function initMemorySchema(db) {
       features TEXT DEFAULT '[]'
     );
   `);
+  const licenseCacheCols = db.prepare(`PRAGMA table_info(license_cache)`).all();
+  if (!licenseCacheCols.some((c) => c.name === "signed_payload_json")) {
+    db.exec(
+      `ALTER TABLE license_cache ADD COLUMN signed_payload_json TEXT NOT NULL DEFAULT ''`
+    );
+  }
   db.exec(`
     CREATE TABLE IF NOT EXISTS failure_classes (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -1117,6 +1141,11 @@ function scoreFailureClasses(db, matchText, filePath, promptContext, weights) {
   return bestMatch;
 }
 
+// src/hooks/lib/write-hook-message.ts
+function writeHookMessage(message) {
+  process.stdout.write(JSON.stringify({ message }) + "\n");
+}
+
 // src/hooks/classify-failure.ts
 var BUG_FIX_INDICATORS = [
   /\b(catch|error|throw|fail|fix|bug|broken|missing|crash|wrong|typo|incorrect)\b/i
@@ -1258,7 +1287,7 @@ function outputKnownPattern(match) {
     lines.push(`  Covered by: ${match.rules.join(", ")}`);
   }
   lines.push("  No new rules needed. Reference existing incident if logging.");
-  console.log(lines.join("\n"));
+  writeHookMessage(lines.join("\n"));
 }
 function outputSimilarPattern(match) {
   const lines = [];
@@ -1268,7 +1297,7 @@ function outputSimilarPattern(match) {
     lines.push(`  Check if existing rules cover this case: ${match.rules.join(", ")}`);
   }
   lines.push("  If genuinely new: create incident + prevention rule + enforcement.");
-  console.log(lines.join("\n"));
+  writeHookMessage(lines.join("\n"));
 }
 function outputNewPattern(fileName, match) {
   const lines = [];
@@ -1282,7 +1311,7 @@ function outputNewPattern(fileName, match) {
   lines.push("    1. INCIDENT REPORT");
   lines.push("    2. PREVENTION RULE (if new failure pattern)");
   lines.push("    3. ENFORCEMENT (hook or static check)");
-  console.log(lines.join("\n"));
+  writeHookMessage(lines.join("\n"));
 }
 function readStdin() {
   return new Promise((resolve3) => {

package/dist/hooks/cost-tracker.js

@@ -348,6 +348,22 @@ var RawConfigSchema = z.object({
   accessScopes: z.array(z.string()).optional(),
   domains: z.array(DomainConfigSchema).default([]),
   rules: z.array(PatternRuleConfigSchema).default([]),
+  // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+  // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+  // used by pattern-scanner). At config-refresh time these entries are
+  // loaded into the `knowledge_rules` SQLite table with
+  // `source = 'customer-config'` so `massu_knowledge_rule` and the
+  // governance docs surface customer-defined rules alongside framework CRs.
+  governance_rules: z.array(
+    z.object({
+      id: z.string().min(1, "governance_rules[].id is required"),
+      title: z.string().min(1, "governance_rules[].title is required"),
+      description: z.string().min(1, "governance_rules[].description is required"),
+      vr_type: z.string().default("VR-CUSTOM"),
+      reference_path: z.string().optional(),
+      severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+    }).passthrough()
+  ).default([]),
   analytics: AnalyticsConfigSchema,
   governance: GovernanceConfigSchema,
   security: SecurityConfigSchema,
@@ -466,6 +482,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -1018,6 +1036,12 @@ function initMemorySchema(db) {
       features TEXT DEFAULT '[]'
     );
   `);
+  const licenseCacheCols = db.prepare(`PRAGMA table_info(license_cache)`).all();
+  if (!licenseCacheCols.some((c) => c.name === "signed_payload_json")) {
+    db.exec(
+      `ALTER TABLE license_cache ADD COLUMN signed_payload_json TEXT NOT NULL DEFAULT ''`
+    );
+  }
   db.exec(`
     CREATE TABLE IF NOT EXISTS failure_classes (
       id INTEGER PRIMARY KEY AUTOINCREMENT,

package/dist/hooks/fix-detector.js

@@ -1,5 +1,11 @@
 #!/usr/bin/env node
 import{createRequire as __cr}from"module";const require=__cr(import.meta.url);
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 
 // src/hooks/fix-detector.ts
 import { execFileSync } from "child_process";
@@ -341,6 +347,22 @@ var RawConfigSchema = z.object({
   accessScopes: z.array(z.string()).optional(),
   domains: z.array(DomainConfigSchema).default([]),
   rules: z.array(PatternRuleConfigSchema).default([]),
+  // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+  // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+  // used by pattern-scanner). At config-refresh time these entries are
+  // loaded into the `knowledge_rules` SQLite table with
+  // `source = 'customer-config'` so `massu_knowledge_rule` and the
+  // governance docs surface customer-defined rules alongside framework CRs.
+  governance_rules: z.array(
+    z.object({
+      id: z.string().min(1, "governance_rules[].id is required"),
+      title: z.string().min(1, "governance_rules[].title is required"),
+      description: z.string().min(1, "governance_rules[].description is required"),
+      vr_type: z.string().default("VR-CUSTOM"),
+      reference_path: z.string().optional(),
+      severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+    }).passthrough()
+  ).default([]),
   analytics: AnalyticsConfigSchema,
   governance: GovernanceConfigSchema,
   security: SecurityConfigSchema,
@@ -459,6 +481,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -489,6 +513,11 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
   return _config;
 }
 
+// src/hooks/lib/write-hook-message.ts
+function writeHookMessage(message) {
+  process.stdout.write(JSON.stringify({ message }) + "\n");
+}
+
 // src/hooks/fix-detector.ts
 var FIX_HEURISTICS = [
   {
@@ -538,6 +567,64 @@ function getSessionFlagPath(sessionId) {
   }
   return join(dir, `fixes-${sessionId.slice(0, 12)}.jsonl`);
 }
+function _stateDir() {
+  const dir = join(tmpdir(), "massu-fix-detector-state");
+  if (!existsSync2(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  return dir;
+}
+function _cwdHash(cwd) {
+  let h = 5381;
+  for (let i = 0; i < cwd.length; i++) {
+    h = (h << 5) + h + cwd.charCodeAt(i) | 0;
+  }
+  return Math.abs(h).toString(36);
+}
+function isGitWorkTreeFast(cwd) {
+  try {
+    const cachePath = join(_stateDir(), `worktree-${_cwdHash(cwd)}.json`);
+    if (existsSync2(cachePath)) {
+      const cached = JSON.parse(readFileSync2(cachePath, "utf-8"));
+      const ageMs = Date.now() - cached.ts;
+      if (ageMs < 36e5) return cached.isWorkTree;
+    }
+    let isWorkTree = false;
+    try {
+      execFileSync("git", ["rev-parse", "--is-inside-work-tree"], { cwd, timeout: 500, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+      isWorkTree = true;
+    } catch {
+      isWorkTree = false;
+    }
+    try {
+      appendFileSync(cachePath, "");
+      const fs = __require("fs");
+      fs.writeFileSync(cachePath, JSON.stringify({ isWorkTree, ts: Date.now() }));
+    } catch {
+    }
+    return isWorkTree;
+  } catch {
+    return false;
+  }
+}
+function _disabledFlagPath(sessionId) {
+  return join(_stateDir(), `disabled-${sessionId.slice(0, 12)}.flag`);
+}
+function isSessionAutoDisabled(sessionId) {
+  try {
+    return existsSync2(_disabledFlagPath(sessionId));
+  } catch {
+    return false;
+  }
+}
+function markSessionAutoDisabled(sessionId, elapsedMs) {
+  try {
+    const fs = __require("fs");
+    fs.writeFileSync(_disabledFlagPath(sessionId), `disabled: previous git diff took ${elapsedMs}ms
+`);
+  } catch {
+  }
+}
 async function main() {
   try {
     const input = await readStdin();
@@ -563,12 +650,21 @@ async function main() {
       return;
     }
     const root = getProjectRoot();
+    if (!isGitWorkTreeFast(root) || isSessionAutoDisabled(hookInput.session_id)) {
+      process.exit(0);
+      return;
+    }
     let diff = "";
     try {
+      const startMs = Date.now();
       diff = execFileSync("git", ["diff", "--", filePath], { cwd: root, timeout: 3e3, encoding: "utf-8" });
       if (!diff) {
         diff = execFileSync("git", ["diff", "HEAD", "--", filePath], { cwd: root, timeout: 3e3, encoding: "utf-8" });
       }
+      const elapsedMs = Date.now() - startMs;
+      if (elapsedMs > 2e3) {
+        markSessionAutoDisabled(hookInput.session_id, elapsedMs);
+      }
     } catch {
       process.exit(0);
       return;
@@ -597,7 +693,7 @@ async function main() {
     appendFileSync(flagPath, JSON.stringify(signal) + "\n");
     const lines = readFileSync2(flagPath, "utf-8").split("\n").filter(Boolean);
     if (lines.length === 1) {
-      console.log(
+      writeHookMessage(
         `[Massu Auto-Learning] Bug fix detected in ${filePath} (signals: ${detected.join(", ")}). The auto-learning pipeline will prompt you at session end to create an incident report, derive a prevention rule, and add enforcement.`
       );
     }

package/dist/hooks/incident-pipeline.js

@@ -347,6 +347,22 @@ var RawConfigSchema = z.object({
   accessScopes: z.array(z.string()).optional(),
   domains: z.array(DomainConfigSchema).default([]),
   rules: z.array(PatternRuleConfigSchema).default([]),
+  // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+  // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+  // used by pattern-scanner). At config-refresh time these entries are
+  // loaded into the `knowledge_rules` SQLite table with
+  // `source = 'customer-config'` so `massu_knowledge_rule` and the
+  // governance docs surface customer-defined rules alongside framework CRs.
+  governance_rules: z.array(
+    z.object({
+      id: z.string().min(1, "governance_rules[].id is required"),
+      title: z.string().min(1, "governance_rules[].title is required"),
+      description: z.string().min(1, "governance_rules[].description is required"),
+      vr_type: z.string().default("VR-CUSTOM"),
+      reference_path: z.string().optional(),
+      severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+    }).passthrough()
+  ).default([]),
   analytics: AnalyticsConfigSchema,
   governance: GovernanceConfigSchema,
   security: SecurityConfigSchema,
@@ -465,6 +481,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -1020,6 +1038,12 @@ function initMemorySchema(db) {
       features TEXT DEFAULT '[]'
     );
   `);
+  const licenseCacheCols = db.prepare(`PRAGMA table_info(license_cache)`).all();
+  if (!licenseCacheCols.some((c) => c.name === "signed_payload_json")) {
+    db.exec(
+      `ALTER TABLE license_cache ADD COLUMN signed_payload_json TEXT NOT NULL DEFAULT ''`
+    );
+  }
   db.exec(`
     CREATE TABLE IF NOT EXISTS failure_classes (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -1143,6 +1167,11 @@ function scoreFailureClasses(db, matchText, filePath, promptContext, weights) {
   return bestMatch;
 }
 
+// src/hooks/lib/write-hook-message.ts
+function writeHookMessage(message) {
+  process.stdout.write(JSON.stringify({ message }) + "\n");
+}
+
 // src/hooks/incident-pipeline.ts
 async function main() {
   try {
@@ -1226,7 +1255,7 @@ async function main() {
     lines.push("  This step is MANDATORY per the auto-learning pipeline.");
     lines.push("============================================================================");
     lines.push("");
-    console.log(lines.join("\n"));
+    writeHookMessage(lines.join("\n"));
     try {
       const taxonomyConfig = config.autoLearning?.failureClassification;
       if (taxonomyConfig?.enabled !== false) {

package/dist/hooks/intent-suggester.js

@@ -1,6 +1,11 @@
 #!/usr/bin/env node
 import{createRequire as __cr}from"module";const require=__cr(import.meta.url);
 
+// src/hooks/lib/write-hook-message.ts
+function writeHookMessage(message) {
+  process.stdout.write(JSON.stringify({ message }) + "\n");
+}
+
 // src/hooks/intent-suggester.ts
 var COMMAND_MAPPINGS = [
   {
@@ -79,9 +84,7 @@ async function main() {
       process.exit(0);
       return;
     }
-    process.stdout.write(
-      `Tip: Use ${match.command} to ${match.description}.`
-    );
+    writeHookMessage(`Tip: Use ${match.command} to ${match.description}.`);
   } catch (_e) {
   }
   process.exit(0);

package/dist/hooks/post-edit-context.js

@@ -346,6 +346,22 @@ var RawConfigSchema = z.object({
   accessScopes: z.array(z.string()).optional(),
   domains: z.array(DomainConfigSchema).default([]),
   rules: z.array(PatternRuleConfigSchema).default([]),
+  // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+  // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+  // used by pattern-scanner). At config-refresh time these entries are
+  // loaded into the `knowledge_rules` SQLite table with
+  // `source = 'customer-config'` so `massu_knowledge_rule` and the
+  // governance docs surface customer-defined rules alongside framework CRs.
+  governance_rules: z.array(
+    z.object({
+      id: z.string().min(1, "governance_rules[].id is required"),
+      title: z.string().min(1, "governance_rules[].title is required"),
+      description: z.string().min(1, "governance_rules[].description is required"),
+      vr_type: z.string().default("VR-CUSTOM"),
+      reference_path: z.string().optional(),
+      severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+    }).passthrough()
+  ).default([]),
   analytics: AnalyticsConfigSchema,
   governance: GovernanceConfigSchema,
   security: SecurityConfigSchema,
@@ -464,6 +480,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -558,6 +576,11 @@ function isInMiddlewareTree(dataDb, file) {
   return result !== void 0;
 }
 
+// src/hooks/lib/write-hook-message.ts
+function writeHookMessage(message) {
+  process.stdout.write(JSON.stringify({ message }) + "\n");
+}
+
 // src/hooks/post-edit-context.ts
 async function main() {
   try {
@@ -595,7 +618,7 @@ async function main() {
     } catch (_e) {
     }
     if (warnings.length > 0) {
-      console.log(`[Massu] ${warnings.join(" | ")}`);
+      writeHookMessage(`[Massu] ${warnings.join(" | ")}`);
     }
   } catch (_e) {
   }