@massu/core 1.10.8 → 1.12.0

package/dist/cli.js

@@ -146,6 +146,8 @@ Hint: run \`massu config refresh\` to regenerate a valid config or fix the liste
     accessScopes: parsed.accessScopes,
     domains: parsed.domains,
     rules: parsed.rules,
+    // P-M-036: customer-authored CR-style governance rules.
+    governance_rules: parsed.governance_rules,
     analytics: parsed.analytics,
     governance: parsed.governance,
     security: parsed.security,
@@ -548,6 +550,22 @@ var init_config = __esm({
       accessScopes: z.array(z.string()).optional(),
       domains: z.array(DomainConfigSchema).default([]),
       rules: z.array(PatternRuleConfigSchema).default([]),
+      // P-M-036 (plan-stage-d-medium-sweep): customer-authored CR-style
+      // governance rules. DISTINCT from `rules:` above (path-scoped lint hints
+      // used by pattern-scanner). At config-refresh time these entries are
+      // loaded into the `knowledge_rules` SQLite table with
+      // `source = 'customer-config'` so `massu_knowledge_rule` and the
+      // governance docs surface customer-defined rules alongside framework CRs.
+      governance_rules: z.array(
+        z.object({
+          id: z.string().min(1, "governance_rules[].id is required"),
+          title: z.string().min(1, "governance_rules[].title is required"),
+          description: z.string().min(1, "governance_rules[].description is required"),
+          vr_type: z.string().default("VR-CUSTOM"),
+          reference_path: z.string().optional(),
+          severity: z.enum(["critical", "high", "medium", "low", "info"]).default("medium")
+        }).passthrough()
+      ).default([]),
       analytics: AnalyticsConfigSchema,
       governance: GovernanceConfigSchema,
       security: SecurityConfigSchema,
@@ -581,6 +599,7 @@ var init_config = __esm({
 // src/memory-db.ts
 var memory_db_exports = {};
 __export(memory_db_exports, {
+  TOOL_COST_EVENTS_RETENTION_DAYS: () => TOOL_COST_EVENTS_RETENTION_DAYS,
   addConversationTurn: () => addConversationTurn,
   addFailureClass: () => addFailureClass,
   addObservation: () => addObservation,
@@ -614,6 +633,7 @@ __export(memory_db_exports, {
   linkSessionToTask: () => linkSessionToTask,
   pruneOldConversationTurns: () => pruneOldConversationTurns,
   pruneOldObservations: () => pruneOldObservations,
+  pruneToolCostEvents: () => pruneToolCostEvents,
   removePendingSync: () => removePendingSync,
   sanitizeFts5Query: () => sanitizeFts5Query,
   scoreFailureClasses: () => scoreFailureClasses,
@@ -642,6 +662,12 @@ function getMemoryDb() {
   initMemorySchema(db);
   return db;
 }
+function pruneToolCostEvents(db) {
+  const result = db.prepare(
+    `DELETE FROM tool_cost_events WHERE created_at < datetime('now', '-' || ? || ' days')`
+  ).run(TOOL_COST_EVENTS_RETENTION_DAYS);
+  return result.changes;
+}
 function initMemorySchema(db) {
   db.exec(`
     -- Sessions table (linked to Claude Code session IDs)
@@ -1116,6 +1142,12 @@ function initMemorySchema(db) {
       features TEXT DEFAULT '[]'
     );
   `);
+  const licenseCacheCols = db.prepare(`PRAGMA table_info(license_cache)`).all();
+  if (!licenseCacheCols.some((c2) => c2.name === "signed_payload_json")) {
+    db.exec(
+      `ALTER TABLE license_cache ADD COLUMN signed_payload_json TEXT NOT NULL DEFAULT ''`
+    );
+  }
   db.exec(`
     CREATE TABLE IF NOT EXISTS failure_classes (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -1688,10 +1720,12 @@ function scoreFailureClasses(db, matchText, filePath, promptContext, weights) {
   }
   return bestMatch;
 }
+var TOOL_COST_EVENTS_RETENTION_DAYS;
 var init_memory_db = __esm({
   "src/memory-db.ts"() {
     "use strict";
     init_config();
+    TOOL_COST_EVENTS_RETENTION_DAYS = 90;
   }
 });
 
@@ -2658,6 +2692,40 @@ var init_install_commands = __esm({
   }
 });
 
+// src/lib/hook-timeouts.ts
+var HOOK_TIMEOUTS;
+var init_hook_timeouts = __esm({
+  "src/lib/hook-timeouts.ts"() {
+    "use strict";
+    HOOK_TIMEOUTS = {
+      // Session lifecycle
+      "session-start": 10,
+      "session-end": 15,
+      "pre-compact": 10,
+      // PreToolUse hooks
+      // P-E-019: `pre-tool-use-gate` is the consolidated PreToolUse hook
+      // (combines security-gate + pre-delete-check into one spawn). The
+      // individual entries below are kept for back-compat with operator
+      // settings.json files that still reference them directly.
+      "pre-tool-use-gate": 5,
+      "security-gate": 5,
+      "pre-delete-check": 5,
+      // PostToolUse hooks
+      "post-tool-use": 10,
+      "quality-event": 5,
+      "cost-tracker": 5,
+      "post-edit-context": 5,
+      // Failure-handling hooks
+      "fix-detector": 5,
+      "classify-failure": 5,
+      "incident-pipeline": 5,
+      "rule-enforcement-pipeline": 5,
+      // Auto-learning
+      "auto-learning-pipeline": 10
+    };
+  }
+});
+
 // src/detect/manifest-registry.ts
 var manifest_registry_exports = {};
 __export(manifest_registry_exports, {
@@ -10567,8 +10635,9 @@ function evictBeyondRetainCount(retain = getCacheRetainCount()) {
       continue;
     }
     if (stat.isSymbolicLink() || !stat.isFile()) {
-      console.error(
-        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).`
+      process.stderr.write(
+        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).
+`
       );
       continue;
     }
@@ -10681,8 +10750,9 @@ async function loadGrammar(language, options = {}) {
     }
     evictBeyondRetainCount();
   } catch (e2) {
-    console.error(
-      `[tree-sitter-loader] cache write failed for ${language}: ${e2 instanceof Error ? e2.message : String(e2)} \u2014 loading directly from memory.`
+    process.stderr.write(
+      `[tree-sitter-loader] cache write failed for ${language}: ${e2 instanceof Error ? e2.message : String(e2)} \u2014 loading directly from memory.
+`
     );
   }
   const lang = await Language.load(body);
@@ -11509,14 +11579,6 @@ var init_python_flask = __esm({
   }
 });
 
-// src/detect/adapters/go-chi.ts
-import { goChiAdapter } from "@massu/adapter-go-chi";
-var init_go_chi = __esm({
-  "src/detect/adapters/go-chi.ts"() {
-    "use strict";
-  }
-});
-
 // src/detect/adapters/rails.ts
 import { railsAdapter } from "@massu/adapter-rails";
 var init_rails = __esm({
@@ -11525,22 +11587,6 @@ var init_rails = __esm({
   }
 });
 
-// src/detect/adapters/phoenix.ts
-import { phoenixAdapter } from "@massu/adapter-phoenix";
-var init_phoenix = __esm({
-  "src/detect/adapters/phoenix.ts"() {
-    "use strict";
-  }
-});
-
-// src/detect/adapters/aspnet.ts
-import { aspnetAdapter } from "@massu/adapter-aspnet";
-var init_aspnet = __esm({
-  "src/detect/adapters/aspnet.ts"() {
-    "use strict";
-  }
-});
-
 // src/detect/adapters/spring.ts
 import { springAdapter } from "@massu/adapter-spring";
 var init_spring = __esm({
@@ -11773,10 +11819,7 @@ var init_codebase_introspector = __esm({
     init_nextjs_trpc();
     init_swift_swiftui();
     init_python_flask();
-    init_go_chi();
     init_rails();
-    init_phoenix();
-    init_aspnet();
     init_spring();
     FIRST_PARTY_ADAPTERS = [
       pythonFastApiAdapter,
@@ -11784,10 +11827,7 @@ var init_codebase_introspector = __esm({
       pythonFlaskAdapter,
       nextjsTrpcAdapter,
       swiftSwiftUiAdapter,
-      goChiAdapter,
       railsAdapter,
-      phoenixAdapter,
-      aspnetAdapter,
       springAdapter
     ];
   }
@@ -13648,46 +13688,50 @@ function resolveHooksDir() {
 function hookCmd(version, hookName) {
   return `npx -y @massu/core@${version} hook-runner ${hookName}`;
 }
+function getHookTimeout(name) {
+  return HOOK_TIMEOUTS[name] ?? 5;
+}
 function buildHooksConfig(_hooksDir) {
   const version = getInstallerVersion();
   return {
     SessionStart: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "session-start"), timeout: 10 }
+          { type: "command", command: hookCmd(version, "session-start"), timeout: getHookTimeout("session-start") }
         ]
       }
     ],
     PreToolUse: [
+      // P-E-019 (plan-stage-e-low-info-sweep): consolidated PreToolUse
+      // gate. Single hook spawn covers BOTH security-gate (Bash
+      // dangerous-pattern + Write/Edit protected-path + Python
+      // dangerous-code) AND pre-delete-check (sentinel feature impact +
+      // Python import graph). Cuts ~200ms of cold-start spawn overhead
+      // per tool call. Matcher includes both Bash + Write so the single
+      // hook fires once for every operation either check cares about.
       {
-        matcher: "Bash",
-        hooks: [
-          { type: "command", command: hookCmd(version, "security-gate"), timeout: 5 }
-        ]
-      },
-      {
-        matcher: "Bash|Write",
+        matcher: "Bash|Write|Edit",
         hooks: [
-          { type: "command", command: hookCmd(version, "pre-delete-check"), timeout: 5 }
+          { type: "command", command: hookCmd(version, "pre-tool-use-gate"), timeout: getHookTimeout("pre-tool-use-gate") }
         ]
       }
     ],
     PostToolUse: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "post-tool-use"), timeout: 10 },
-          { type: "command", command: hookCmd(version, "quality-event"), timeout: 5 },
-          { type: "command", command: hookCmd(version, "cost-tracker"), timeout: 5 }
+          { type: "command", command: hookCmd(version, "post-tool-use"), timeout: getHookTimeout("post-tool-use") },
+          { type: "command", command: hookCmd(version, "quality-event"), timeout: getHookTimeout("quality-event") },
+          { type: "command", command: hookCmd(version, "cost-tracker"), timeout: getHookTimeout("cost-tracker") }
         ]
       },
       {
         matcher: "Edit|Write",
         hooks: [
-          { type: "command", command: hookCmd(version, "post-edit-context"), timeout: 5 },
+          { type: "command", command: hookCmd(version, "post-edit-context"), timeout: getHookTimeout("post-edit-context") },
           // Auto-learning pipeline — classifies failures and detects fixes on
           // file changes. See Phase 5-6 of the autodetect plan.
-          { type: "command", command: hookCmd(version, "fix-detector"), timeout: 5 },
-          { type: "command", command: hookCmd(version, "classify-failure"), timeout: 5 }
+          { type: "command", command: hookCmd(version, "fix-detector"), timeout: getHookTimeout("fix-detector") },
+          { type: "command", command: hookCmd(version, "classify-failure"), timeout: getHookTimeout("classify-failure") }
         ]
       },
       {
@@ -13695,32 +13739,32 @@ function buildHooksConfig(_hooksDir) {
         hooks: [
           // Incident + rule enforcement pipelines fire on Write-only (incidents
           // are authored as .md files; rules are enforced after new-file drops).
-          { type: "command", command: hookCmd(version, "incident-pipeline"), timeout: 5 },
-          { type: "command", command: hookCmd(version, "rule-enforcement-pipeline"), timeout: 5 }
+          { type: "command", command: hookCmd(version, "incident-pipeline"), timeout: getHookTimeout("incident-pipeline") },
+          { type: "command", command: hookCmd(version, "rule-enforcement-pipeline"), timeout: getHookTimeout("rule-enforcement-pipeline") }
         ]
       }
     ],
     Stop: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "session-end"), timeout: 15 },
+          { type: "command", command: hookCmd(version, "session-end"), timeout: getHookTimeout("session-end") },
           // Session-end auto-learning aggregation (failure-class roll-up).
-          { type: "command", command: hookCmd(version, "auto-learning-pipeline"), timeout: 10 }
+          { type: "command", command: hookCmd(version, "auto-learning-pipeline"), timeout: getHookTimeout("auto-learning-pipeline") }
         ]
       }
     ],
     PreCompact: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "pre-compact"), timeout: 10 }
+          { type: "command", command: hookCmd(version, "pre-compact"), timeout: getHookTimeout("pre-compact") }
         ]
       }
     ],
     UserPromptSubmit: [
       {
         hooks: [
-          { type: "command", command: hookCmd(version, "user-prompt"), timeout: 5 },
-          { type: "command", command: hookCmd(version, "intent-suggester"), timeout: 5 }
+          { type: "command", command: hookCmd(version, "user-prompt"), timeout: getHookTimeout("user-prompt") },
+          { type: "command", command: hookCmd(version, "intent-suggester"), timeout: getHookTimeout("intent-suggester") }
         ]
       }
     ]
@@ -13905,7 +13949,15 @@ function summarizeDetection2(detection) {
     const dirs = detection.sourceDirs[lang]?.source_dirs ?? [];
     const dirSuffix = dirs.length > 0 ? ` in ${dirs.join(",")}` : "";
     const fwName = fw?.framework ?? "no-framework";
-    parts.push(`${capitalize(lang)}/${fwName}${dirSuffix}`);
+    const slotParts = [];
+    const router = fw?.router;
+    const orm = fw?.orm;
+    const ui = fw?.ui;
+    if (router && router !== "none") slotParts.push(`router=${router}`);
+    if (orm && orm !== "none") slotParts.push(`orm=${orm}`);
+    if (ui && ui !== "none") slotParts.push(`ui=${ui}`);
+    const slotSuffix = slotParts.length > 0 ? ` (${slotParts.join(", ")})` : "";
+    parts.push(`${capitalize(lang)}/${fwName}${slotSuffix}${dirSuffix}`);
   }
   const mono = detection.monorepo.type;
   const monoSuffix = mono && mono !== "single" ? ` [${mono} monorepo]` : "";
@@ -14178,6 +14230,7 @@ var init_init = __esm({
     init_install_commands();
     init_settings_local();
     init_memory_path();
+    init_hook_timeouts();
     init_detect();
     init_drift();
     __filename2 = fileURLToPath2(import.meta.url);
@@ -14216,7 +14269,7 @@ var init_license_pubkey_generated = __esm({
 });
 
 // src/security/license-response-verifier.ts
-import { createPublicKey } from "crypto";
+import { createPublicKey, verify as cryptoVerify } from "crypto";
 function verifyLicenseResponse(payload) {
   if (!KNOWN_LICENSE_PUBKEY_FINGERPRINTS.has(LICENSE_PUBKEY_FINGERPRINT_HEX)) {
     return {
@@ -14263,8 +14316,7 @@ function verifyLicenseResponse(payload) {
     ]);
     const der = Buffer.concat([spkiPrefix, Buffer.from(LICENSE_PUBKEY_ED25519)]);
     const pubkey = createPublicKey({ key: der, format: "der", type: "spki" });
-    const { verify } = __require("crypto");
-    const ok = verify(
+    const ok = cryptoVerify(
       null,
       Buffer.from(canonical, "utf-8"),
       pubkey,
@@ -14311,13 +14363,31 @@ function isToolAllowed(toolName, userTier) {
   return tierLevel(userTier) >= tierLevel(requiredTier);
 }
 function annotateToolDefinitions(defs) {
+  for (const def of defs) {
+    const expectedTier = getToolTier(def.name);
+    const incomingTier = def.annotations?.tier;
+    if (incomingTier !== void 0 && incomingTier !== expectedTier) {
+      throw new Error(
+        `TOOL_TIER_MAP bijection violation (P-M-033): tool "${def.name}" has annotations.tier="${incomingTier}" but TOOL_TIER_MAP says "${expectedTier}". TOOL_TIER_MAP is the SoT \u2014 fix the source instead.`
+      );
+    }
+    const expectedPrefix = TIER_LABELS[expectedTier];
+    for (const otherPrefix of Object.values(TIER_LABELS)) {
+      if (otherPrefix && otherPrefix !== expectedPrefix && def.description.startsWith(otherPrefix)) {
+        throw new Error(
+          `TOOL_TIER_MAP bijection violation (P-M-033): tool "${def.name}" description starts with "${otherPrefix}" but TOOL_TIER_MAP tier is "${expectedTier}" (expected prefix "${expectedPrefix}").`
+        );
+      }
+    }
+  }
   return defs.map((def) => {
     const tier = getToolTier(def.name);
     const label = TIER_LABELS[tier];
+    const stripped = label && def.description.startsWith(label) ? def.description.slice(label.length) : def.description;
     return {
       ...def,
       annotations: { ...def.annotations ?? {}, tier },
-      description: label ? `${label}${def.description}` : def.description
+      description: label ? `${label}${stripped}` : stripped
     };
   });
 }
@@ -14329,17 +14399,14 @@ async function validateLicense(apiKey) {
   const memDb = getMemoryDb();
   try {
     const cached = memDb.prepare(
-      "SELECT tier, valid_until, last_validated, features FROM license_cache WHERE api_key_hash = ?"
+      "SELECT tier, valid_until, last_validated, features, signed_payload_json FROM license_cache WHERE api_key_hash = ?"
     ).get(keyHash);
-    if (cached) {
+    const trusted = cached ? readTrustedCache(cached) : null;
+    if (cached && trusted) {
       const lastValidated = new Date(cached.last_validated);
       const hourAgo = new Date(Date.now() - 60 * 60 * 1e3);
       if (lastValidated > hourAgo) {
-        return {
-          tier: cached.tier,
-          validUntil: cached.valid_until,
-          features: JSON.parse(cached.features || "[]")
-        };
+        return trusted;
       }
     }
     const config = getConfig();
@@ -14368,7 +14435,13 @@ async function validateLicense(apiKey) {
             const tier = data.plan ? PLAN_TO_TIER_MAP[data.plan] ?? "free" : data.tier ?? "free";
             const validUntil = data.validUntil ?? "";
             const features = data.features ?? [];
-            updateLicenseCache(apiKey, tier, validUntil, features);
+            updateLicenseCache(
+              apiKey,
+              tier,
+              validUntil,
+              features,
+              sigResult.kind === "valid" ? data : null
+            );
             return { tier, validUntil, features };
           }
           return { tier: "free", validUntil: "", features: [] };
@@ -14376,15 +14449,11 @@ async function validateLicense(apiKey) {
       } catch {
       }
     }
-    if (cached) {
+    if (cached && trusted) {
       const lastValidated = new Date(cached.last_validated);
       const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3);
       if (lastValidated > sevenDaysAgo) {
-        return {
-          tier: cached.tier,
-          validUntil: cached.valid_until,
-          features: JSON.parse(cached.features || "[]")
-        };
+        return trusted;
       }
     }
     return { tier: "free", validUntil: "", features: [] };
@@ -14392,18 +14461,49 @@ async function validateLicense(apiKey) {
     memDb.close();
   }
 }
-function updateLicenseCache(apiKey, tier, validUntil, features = []) {
+function updateLicenseCache(apiKey, tier, validUntil, features = [], signedPayload = null) {
   const keyHash = createHash5("sha256").update(apiKey).digest("hex");
   const memDb = getMemoryDb();
   try {
     memDb.prepare(`
-      INSERT OR REPLACE INTO license_cache (api_key_hash, tier, valid_until, last_validated, features)
-      VALUES (?, ?, ?, datetime('now'), ?)
-    `).run(keyHash, tier, validUntil, JSON.stringify(features));
+      INSERT OR REPLACE INTO license_cache (api_key_hash, tier, valid_until, last_validated, features, signed_payload_json)
+      VALUES (?, ?, ?, datetime('now'), ?, ?)
+    `).run(
+      keyHash,
+      tier,
+      validUntil,
+      JSON.stringify(features),
+      signedPayload ? JSON.stringify(signedPayload) : ""
+    );
   } finally {
     memDb.close();
   }
 }
+function readTrustedCache(cached) {
+  if (!cached.signed_payload_json) {
+    if (isLicenseSignatureRequired()) return null;
+    warnLicenseSigOnce("cache_unsigned_transition");
+    return {
+      tier: cached.tier,
+      validUntil: cached.valid_until,
+      features: JSON.parse(cached.features || "[]")
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(cached.signed_payload_json);
+  } catch {
+    return null;
+  }
+  const result = verifyLicenseResponse(parsed);
+  if (result.kind !== "valid") return null;
+  const verifiedPlan = typeof parsed.plan === "string" ? parsed.plan : null;
+  const verifiedTierField = typeof parsed.tier === "string" ? parsed.tier : null;
+  const tier = verifiedPlan ? PLAN_TO_TIER_MAP[verifiedPlan] ?? "free" : verifiedTierField ?? "free";
+  const validUntil = typeof parsed.validUntil === "string" ? parsed.validUntil : "";
+  const features = Array.isArray(parsed.features) ? parsed.features : [];
+  return { tier, validUntil, features };
+}
 async function getCurrentTier() {
   if (cachedTier && Date.now() - cachedTierTimestamp < IN_MEMORY_CACHE_TTL_MS) {
     return cachedTier.tier;
@@ -14511,6 +14611,12 @@ var init_license = __esm({
       coupling_check: "free",
       memory_search: "free",
       memory_ingest: "free",
+      // P-M-042 (plan-stage-d-medium-sweep): memory_backfill serves the
+      // customer's MEMORY.md ingestion workflow and was registered in
+      // memory-tools.ts but missing from TOOL_TIER_MAP. The bijection
+      // drift-guard (P-M-033) would have caught it on next add; we land it
+      // explicitly as Free since it's a customer-owned-data ingestion path.
+      memory_backfill: "free",
       regression_risk: "free",
       feature_health: "free",
       license_status: "free",
@@ -14586,7 +14692,7 @@ var init_license = __esm({
       cloud_enterprise: "enterprise"
     };
     TIER_LABELS = {
-      free: "",
+      free: "[FREE] ",
       pro: "[PRO] ",
       team: "[TEAM] ",
       enterprise: "[ENTERPRISE] "
@@ -14615,7 +14721,12 @@ var init_hook_registry = __esm({
       "post-edit-context",
       "post-tool-use",
       "pre-compact",
+      // P-E-019 (1.12.0): security-gate + pre-delete-check are kept registered
+      // for back-compat (operator settings.json may still reference them
+      // individually), but new installs emit only `pre-tool-use-gate` —
+      // the consolidated single-spawn PreToolUse hook.
       "pre-delete-check",
+      "pre-tool-use-gate",
       "quality-event",
       "rule-enforcement-pipeline",
       "security-gate",
@@ -18027,10 +18138,11 @@ var init_adapters = __esm({
   "src/detect/adapters/index.ts"() {
     "use strict";
     CORE_BUNDLED_IDS = /* @__PURE__ */ new Set([
-      "aspnet",
-      "go-chi",
+      // P-M-032 (plan-stage-d-medium-sweep): aspnet, go-chi, phoenix REMOVED
+      // — zero downstream consumers (each had a single 1-line re-export shim).
+      // Rails (5 consumers) + Spring (1 consumer) deferred to Stage E as the
+      // JVM/Ruby ecosystem-watch pair per operator decision.
       "nextjs-trpc",
-      "phoenix",
       "python-django",
       "python-fastapi",
       "python-flask",
@@ -18977,6 +19089,184 @@ var init_db = __esm({
   }
 });
 
+// src/knowledge-db.ts
+import Database3 from "better-sqlite3";
+import { dirname as dirname14 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync11 } from "fs";
+function getKnowledgeDb() {
+  const dbPath = getResolvedPaths().knowledgeDbPath;
+  const dir = dirname14(dbPath);
+  if (!existsSync28(dir)) {
+    mkdirSync11(dir, { recursive: true });
+  }
+  const db = new Database3(dbPath);
+  db.pragma("journal_mode = WAL");
+  db.pragma("foreign_keys = ON");
+  initKnowledgeSchema(db);
+  return db;
+}
+function initKnowledgeSchema(db) {
+  db.exec(`
+    -- Core document chunks (parsed from .claude/**/*.md)
+    CREATE TABLE IF NOT EXISTS knowledge_documents (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      file_path TEXT NOT NULL,
+      category TEXT NOT NULL,
+      title TEXT NOT NULL,
+      description TEXT,
+      content_hash TEXT NOT NULL,
+      indexed_at TEXT NOT NULL,
+      indexed_at_epoch INTEGER NOT NULL
+    );
+
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_kd_filepath ON knowledge_documents(file_path);
+    CREATE INDEX IF NOT EXISTS idx_kd_category ON knowledge_documents(category);
+
+    -- Structured chunks within documents
+    CREATE TABLE IF NOT EXISTS knowledge_chunks (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      document_id INTEGER NOT NULL REFERENCES knowledge_documents(id) ON DELETE CASCADE,
+      chunk_type TEXT NOT NULL CHECK(chunk_type IN (
+        'section', 'table_row', 'code_block', 'rule', 'incident', 'pattern', 'command', 'mismatch'
+      )),
+      heading TEXT,
+      content TEXT NOT NULL,
+      line_start INTEGER,
+      line_end INTEGER,
+      metadata TEXT DEFAULT '{}'
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_kc_doc ON knowledge_chunks(document_id);
+    CREATE INDEX IF NOT EXISTS idx_kc_type ON knowledge_chunks(chunk_type);
+    CREATE INDEX IF NOT EXISTS idx_kc_heading ON knowledge_chunks(heading);
+
+    -- Canonical Rules index
+    CREATE TABLE IF NOT EXISTS knowledge_rules (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      rule_id TEXT UNIQUE NOT NULL,
+      rule_text TEXT NOT NULL,
+      vr_type TEXT,
+      reference_path TEXT,
+      severity TEXT DEFAULT 'HIGH',
+      prevention_summary TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_kr_id ON knowledge_rules(rule_id);
+  `);
+  const rulesCols = db.prepare(`PRAGMA table_info(knowledge_rules)`).all();
+  if (!rulesCols.some((c2) => c2.name === "source")) {
+    db.exec(
+      `ALTER TABLE knowledge_rules ADD COLUMN source TEXT NOT NULL DEFAULT 'framework'`
+    );
+  }
+  db.exec(`
+
+    -- Verification Requirements index
+    CREATE TABLE IF NOT EXISTS knowledge_verifications (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      vr_type TEXT UNIQUE NOT NULL,
+      command TEXT NOT NULL,
+      expected TEXT NOT NULL,
+      use_when TEXT NOT NULL,
+      catches TEXT,
+      category TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_kv_type ON knowledge_verifications(vr_type);
+    CREATE INDEX IF NOT EXISTS idx_kv_category ON knowledge_verifications(category);
+
+    -- Incident index
+    CREATE TABLE IF NOT EXISTS knowledge_incidents (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      incident_num INTEGER UNIQUE NOT NULL,
+      date TEXT NOT NULL,
+      type TEXT NOT NULL,
+      gap_found TEXT NOT NULL,
+      prevention TEXT NOT NULL,
+      cr_added TEXT,
+      root_cause TEXT,
+      user_quote TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_ki_num ON knowledge_incidents(incident_num);
+    CREATE INDEX IF NOT EXISTS idx_ki_type ON knowledge_incidents(type);
+    CREATE INDEX IF NOT EXISTS idx_ki_cr ON knowledge_incidents(cr_added);
+
+    -- Schema mismatch quick lookup
+    -- P-H013 (plan-stage-c-high-batch): the source column no longer has a
+    -- SQL DEFAULT. Previously the value was a JS template-literal
+    -- interpolation baked into the customer SQLite at schema creation
+    -- time, so later config changes were ignored. Default is now applied
+    -- at INSERT time via getConfig().conventions.knowledgeSourceFiles[0]
+    -- in knowledge-indexer.ts -- a runtime config lookup that reflects
+    -- the customers current config.
+    CREATE TABLE IF NOT EXISTS knowledge_schema_mismatches (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      table_name TEXT NOT NULL,
+      wrong_column TEXT NOT NULL,
+      correct_column TEXT NOT NULL,
+      source TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_ksm_table ON knowledge_schema_mismatches(table_name);
+
+    -- Cross-reference graph
+    CREATE TABLE IF NOT EXISTS knowledge_edges (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      source_type TEXT NOT NULL,
+      source_id TEXT NOT NULL,
+      target_type TEXT NOT NULL,
+      target_id TEXT NOT NULL,
+      edge_type TEXT NOT NULL
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_ke_source ON knowledge_edges(source_type, source_id);
+    CREATE INDEX IF NOT EXISTS idx_ke_target ON knowledge_edges(target_type, target_id);
+    CREATE UNIQUE INDEX IF NOT EXISTS idx_ke_unique ON knowledge_edges(source_type, source_id, target_type, target_id, edge_type);
+
+    -- Staleness tracking
+    CREATE TABLE IF NOT EXISTS knowledge_meta (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+  `);
+  try {
+    db.exec(`
+      CREATE VIRTUAL TABLE IF NOT EXISTS knowledge_fts USING fts5(
+        heading, content, chunk_type, file_path
+      );
+
+      CREATE TRIGGER IF NOT EXISTS kc_fts_insert AFTER INSERT ON knowledge_chunks BEGIN
+        INSERT INTO knowledge_fts(rowid, heading, content, chunk_type, file_path)
+        SELECT new.id, new.heading, new.content, new.chunk_type, kd.file_path
+        FROM knowledge_documents kd WHERE kd.id = new.document_id;
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS kc_fts_delete AFTER DELETE ON knowledge_chunks BEGIN
+        INSERT INTO knowledge_fts(knowledge_fts, rowid, heading, content, chunk_type, file_path)
+        SELECT 'delete', old.id, old.heading, old.content, old.chunk_type, kd.file_path
+        FROM knowledge_documents kd WHERE kd.id = old.document_id;
+      END;
+
+      CREATE TRIGGER IF NOT EXISTS kc_fts_update AFTER UPDATE ON knowledge_chunks BEGIN
+        INSERT INTO knowledge_fts(knowledge_fts, rowid, heading, content, chunk_type, file_path)
+        SELECT 'delete', old.id, old.heading, old.content, old.chunk_type, kd.file_path
+        FROM knowledge_documents kd WHERE kd.id = old.document_id;
+        INSERT INTO knowledge_fts(rowid, heading, content, chunk_type, file_path)
+        SELECT new.id, new.heading, new.content, new.chunk_type, kd.file_path
+        FROM knowledge_documents kd WHERE kd.id = new.document_id;
+      END;
+    `);
+  } catch {
+  }
+}
+var init_knowledge_db = __esm({
+  "src/knowledge-db.ts"() {
+    "use strict";
+    init_config();
+  }
+});
+
 // src/security-utils.ts
 import { resolve as resolve24, normalize } from "path";
 function ensureWithinRoot(filePath, projectRoot) {
@@ -19054,8 +19344,8 @@ var init_rules = __esm({
 });
 
 // src/import-resolver.ts
-import { readFileSync as readFileSync25, existsSync as existsSync28, statSync as statSync12 } from "fs";
-import { resolve as resolve25, dirname as dirname14, join as join13 } from "path";
+import { readFileSync as readFileSync25, existsSync as existsSync29, statSync as statSync12 } from "fs";
+import { resolve as resolve25, dirname as dirname15, join as join13 } from "path";
 function parseImports(source) {
   const imports = [];
   const lines = source.split("\n");
@@ -19113,21 +19403,21 @@ function resolveImportPath(specifier, fromFile) {
     const paths = getResolvedPaths();
     basePath = resolve25(paths.pathAlias["@"] ?? paths.srcDir, specifier.slice(2));
   } else {
-    basePath = resolve25(dirname14(fromFile), specifier);
+    basePath = resolve25(dirname15(fromFile), specifier);
   }
-  if (existsSync28(basePath) && !isDirectory(basePath)) {
+  if (existsSync29(basePath) && !isDirectory(basePath)) {
     return toRelative(basePath);
   }
   const resolvedPaths = getResolvedPaths();
   for (const ext of resolvedPaths.extensions) {
     const withExt = basePath + ext;
-    if (existsSync28(withExt)) {
+    if (existsSync29(withExt)) {
       return toRelative(withExt);
     }
   }
   for (const indexFile of resolvedPaths.indexFiles) {
     const indexPath = join13(basePath, indexFile);
-    if (existsSync28(indexPath)) {
+    if (existsSync29(indexPath)) {
       return toRelative(indexPath);
     }
   }
@@ -19164,7 +19454,7 @@ function buildImportIndex(dataDb, codegraphDb) {
   let batch = [];
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve25(projectRoot, file.path), projectRoot);
-    if (!existsSync28(absPath)) continue;
+    if (!existsSync29(absPath)) continue;
     let source;
     try {
       source = readFileSync25(absPath, "utf-8");
@@ -19204,12 +19494,12 @@ var init_import_resolver = __esm({
 });
 
 // src/trpc-index.ts
-import { readFileSync as readFileSync26, existsSync as existsSync29, readdirSync as readdirSync16 } from "fs";
+import { readFileSync as readFileSync26, existsSync as existsSync30, readdirSync as readdirSync16 } from "fs";
 import { resolve as resolve26, join as join14 } from "path";
 function parseRootRouter() {
   const paths = getResolvedPaths();
   const rootPath = paths.rootRouterPath;
-  if (!existsSync29(rootPath)) {
+  if (!existsSync30(rootPath)) {
     throw new Error(`Root router not found at ${rootPath}`);
   }
   const source = readFileSync26(rootPath, "utf-8");
@@ -19224,12 +19514,12 @@ function parseRootRouter() {
     for (const ext of [".ts", ".tsx", ""]) {
       const candidate = fullPath + ext;
       const routersRelPath = getConfig().paths.routers ?? "src/server/api/routers";
-      if (existsSync29(candidate)) {
+      if (existsSync30(candidate)) {
         filePath = routersRelPath + "/" + filePath + ext;
         break;
       }
       const indexCandidate = join14(fullPath, "index.ts");
-      if (existsSync29(indexCandidate)) {
+      if (existsSync30(indexCandidate)) {
         filePath = routersRelPath + "/" + filePath + "/index.ts";
         break;
       }
@@ -19249,7 +19539,7 @@ function parseRootRouter() {
 }
 function extractProcedures(routerFilePath) {
   const absPath = resolve26(getProjectRoot(), routerFilePath);
-  if (!existsSync29(absPath)) return [];
+  if (!existsSync30(absPath)) return [];
   const source = readFileSync26(absPath, "utf-8");
   const procedures = [];
   const seen = /* @__PURE__ */ new Set();
@@ -19279,7 +19569,7 @@ function findUICallSites(routerKey, procedureName) {
   ];
   const searchPattern = `api.${routerKey}.${procedureName}`;
   for (const dir of searchDirs) {
-    if (!existsSync29(dir)) continue;
+    if (!existsSync30(dir)) continue;
     searchDirectory(dir, searchPattern, callSites);
   }
   return callSites;
@@ -19357,7 +19647,7 @@ var init_trpc_index = __esm({
 });
 
 // src/page-deps.ts
-import { readFileSync as readFileSync27, existsSync as existsSync30 } from "fs";
+import { readFileSync as readFileSync27, existsSync as existsSync31 } from "fs";
 import { resolve as resolve27 } from "path";
 function deriveRoute(pageFile) {
   let route = pageFile.replace(/^src\/app/, "").replace(/\/page\.tsx?$/, "").replace(/\/page\.jsx?$/, "");
@@ -19397,7 +19687,7 @@ function findRouterCalls(files) {
   const projectRoot = getProjectRoot();
   for (const file of files) {
     const absPath = ensureWithinRoot(resolve27(projectRoot, file), projectRoot);
-    if (!existsSync30(absPath)) continue;
+    if (!existsSync31(absPath)) continue;
     try {
       const source = readFileSync27(absPath, "utf-8");
       const apiCallRegex = /api\.(\w+)\.\w+/g;
@@ -19418,7 +19708,7 @@ function findTablesFromRouters(routerNames, dataDb) {
     ).all(routerName);
     for (const proc of procs) {
       const absPath = ensureWithinRoot(resolve27(getProjectRoot(), proc.router_file), getProjectRoot());
-      if (!existsSync30(absPath)) continue;
+      if (!existsSync31(absPath)) continue;
       try {
         const source = readFileSync27(absPath, "utf-8");
         const dbPattern = getConfig().dbAccessPattern ?? "ctx.db.{table}";
@@ -19692,11 +19982,11 @@ var init_domains = __esm({
 });
 
 // src/schema-mapper.ts
-import { readFileSync as readFileSync28, existsSync as existsSync31, readdirSync as readdirSync17 } from "fs";
+import { readFileSync as readFileSync28, existsSync as existsSync32, readdirSync as readdirSync17 } from "fs";
 import { join as join15 } from "path";
 function parsePrismaSchema() {
   const schemaPath = getResolvedPaths().prismaSchemaPath;
-  if (!existsSync31(schemaPath)) {
+  if (!existsSync32(schemaPath)) {
     throw new Error(`Prisma schema not found at ${schemaPath}`);
   }
   const source = readFileSync28(schemaPath, "utf-8");
@@ -19757,7 +20047,7 @@ function toSnakeCase(str) {
 function findColumnUsageInRouters(tableName) {
   const usage = /* @__PURE__ */ new Map();
   const routersDir = getResolvedPaths().routersDir;
-  if (!existsSync31(routersDir)) return usage;
+  if (!existsSync32(routersDir)) return usage;
   scanDirectory(routersDir, tableName, usage);
   return usage;
 }
@@ -19819,7 +20109,7 @@ function detectMismatches(models) {
 }
 function findFilesUsingColumn(dir, column, tableName) {
   const result = [];
-  if (!existsSync31(dir)) return result;
+  if (!existsSync32(dir)) return result;
   const entries = readdirSync17(dir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = join15(dir, entry.name);
@@ -19972,14 +20262,14 @@ var init_import_parser = __esm({
 });
 
 // src/python/import-resolver.ts
-import { readFileSync as readFileSync29, existsSync as existsSync32, readdirSync as readdirSync18 } from "fs";
-import { resolve as resolve29, join as join16, relative as relative6, dirname as dirname15 } from "path";
+import { readFileSync as readFileSync29, existsSync as existsSync33, readdirSync as readdirSync18 } from "fs";
+import { resolve as resolve29, join as join16, relative as relative6, dirname as dirname16 } from "path";
 function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   const projectRoot = getProjectRoot();
   if (level > 0) {
-    let baseDir = dirname15(resolve29(projectRoot, fromFile));
+    let baseDir = dirname16(resolve29(projectRoot, fromFile));
     for (let i = 1; i < level; i++) {
-      baseDir = dirname15(baseDir);
+      baseDir = dirname16(baseDir);
     }
     const modulePart = module.replace(/^\.+/, "");
     if (modulePart) {
@@ -19993,13 +20283,13 @@ function resolvePythonModulePath(module, fromFile, pythonRoot, level) {
   return tryResolvePythonPath(candidate, projectRoot);
 }
 function tryResolvePythonPath(basePath, projectRoot) {
-  if (existsSync32(basePath + ".py")) {
+  if (existsSync33(basePath + ".py")) {
     return relative6(projectRoot, basePath + ".py");
   }
-  if (existsSync32(join16(basePath, "__init__.py"))) {
+  if (existsSync33(join16(basePath, "__init__.py"))) {
     return relative6(projectRoot, join16(basePath, "__init__.py"));
   }
-  if (basePath.endsWith(".py") && existsSync32(basePath)) {
+  if (basePath.endsWith(".py") && existsSync33(basePath)) {
     return relative6(projectRoot, basePath);
   }
   return null;
@@ -21352,7 +21642,7 @@ var init_memory_tools = __esm({
 });
 
 // src/docs-tools.ts
-import { readFileSync as readFileSync34, existsSync as existsSync33 } from "fs";
+import { readFileSync as readFileSync34, existsSync as existsSync34 } from "fs";
 import { resolve as resolve30, basename as basename6 } from "path";
 function p3(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -21408,7 +21698,7 @@ function handleDocsToolCall(name, args2) {
 }
 function loadDocsMap() {
   const mapPath = getResolvedPaths().docsMapPath;
-  if (!existsSync33(mapPath)) {
+  if (!existsSync34(mapPath)) {
     throw new Error(`docs-map.json not found at ${mapPath}`);
   }
   return JSON.parse(readFileSync34(mapPath, "utf-8"));
@@ -21482,9 +21772,9 @@ function extractFrontmatter(content) {
 function extractProcedureNames(routerPath) {
   const root = getProjectRoot();
   const absPath = ensureWithinRoot(resolve30(getResolvedPaths().srcDir, "..", routerPath), root);
-  if (!existsSync33(absPath)) {
+  if (!existsSync34(absPath)) {
     const altPath = ensureWithinRoot(resolve30(getResolvedPaths().srcDir, "../server/api/routers", basename6(routerPath)), root);
-    if (!existsSync33(altPath)) return [];
+    if (!existsSync34(altPath)) return [];
     return extractProcedureNamesFromContent(readFileSync34(altPath, "utf-8"));
   }
   return extractProcedureNamesFromContent(readFileSync34(absPath, "utf-8"));
@@ -21528,7 +21818,7 @@ function handleDocsAudit(args2) {
     const mapping = docsMap.mappings.find((m3) => m3.id === mappingId);
     if (!mapping) continue;
     const helpPagePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    if (!existsSync33(helpPagePath)) {
+    if (!existsSync34(helpPagePath)) {
       results.push({
         helpPage: mapping.helpPage,
         mappingId,
@@ -21581,7 +21871,7 @@ function handleDocsAudit(args2) {
     for (const [guideName, parentId] of Object.entries(docsMap.userGuideInheritance.examples)) {
       if (parentId === mappingId) {
         const guidePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, `pages/user-guides/${guideName}/index.mdx`), getProjectRoot());
-        if (existsSync33(guidePath)) {
+        if (existsSync34(guidePath)) {
           const guideContent = readFileSync34(guidePath, "utf-8");
           const guideFrontmatter = extractFrontmatter(guideContent);
           if (!guideFrontmatter?.lastVerified || status === "STALE") {
@@ -21616,7 +21906,7 @@ function handleDocsCoverage(args2) {
   const mappings = filterDomain ? docsMap.mappings.filter((m3) => m3.id === filterDomain) : docsMap.mappings;
   for (const mapping of mappings) {
     const helpPagePath = ensureWithinRoot(resolve30(getResolvedPaths().helpSitePath, mapping.helpPage), getProjectRoot());
-    const exists = existsSync33(helpPagePath);
+    const exists = existsSync34(helpPagePath);
     let hasContent = false;
     let lineCount = 0;
     let lastVerified = null;
@@ -21963,7 +22253,7 @@ var init_observability_tools = __esm({
 });
 
 // src/sentinel-db.ts
-import { existsSync as existsSync34 } from "fs";
+import { existsSync as existsSync35 } from "fs";
 import { resolve as resolve31 } from "path";
 function parsePortalScope(raw) {
   if (!raw) return [];
@@ -22201,22 +22491,22 @@ function validateFeatures(db, domainFilter) {
     const missingPages = [];
     for (const comp of components) {
       const absPath = resolve31(PROJECT_ROOT, comp.component_file);
-      if (!existsSync34(absPath)) {
+      if (!existsSync35(absPath)) {
         missingComponents.push(comp.component_file);
       }
     }
     for (const proc of procedures) {
       const routerPath = resolve31(PROJECT_ROOT, `src/server/api/routers/${proc.router_name}.ts`);
-      if (!existsSync34(routerPath)) {
+      if (!existsSync35(routerPath)) {
         missingProcedures.push({ router: proc.router_name, procedure: proc.procedure_name });
       }
     }
     for (const page of pages) {
       const routeToPath = page.page_route.replace(/^\/(portal-[^/]+\/)?/, "src/app/").replace(/\/$/, "") + "/page.tsx";
       const absPath = resolve31(PROJECT_ROOT, routeToPath);
-      if (page.page_route.startsWith("/") && !existsSync34(absPath)) {
+      if (page.page_route.startsWith("/") && !existsSync35(absPath)) {
         const altPath = resolve31(PROJECT_ROOT, `src/app${page.page_route}/page.tsx`);
-        if (!existsSync34(altPath)) {
+        if (!existsSync35(altPath)) {
           missingPages.push(page.page_route);
         }
       }
@@ -22742,8 +23032,8 @@ var init_sentinel_tools = __esm({
 });
 
 // src/sentinel-scanner.ts
-import { readFileSync as readFileSync35, existsSync as existsSync35, readdirSync as readdirSync23, statSync as statSync13 } from "fs";
-import { resolve as resolve32, join as join21, basename as basename7, dirname as dirname16, relative as relative11 } from "path";
+import { readFileSync as readFileSync35, existsSync as existsSync36, readdirSync as readdirSync23, statSync as statSync13 } from "fs";
+import { resolve as resolve32, join as join21, basename as basename7, dirname as dirname17, relative as relative11 } from "path";
 function inferDomain(filePath) {
   const domains = getConfig().domains;
   const path = filePath.toLowerCase();
@@ -22873,7 +23163,7 @@ function scanComponentExports(dataDb) {
   const componentsBase = config.paths.components ?? config.paths.source + "/components";
   const componentDirs = [];
   const basePath = resolve32(projectRoot, componentsBase);
-  if (existsSync35(basePath)) {
+  if (existsSync36(basePath)) {
     try {
       const entries = readdirSync23(basePath, { withFileTypes: true });
       for (const entry of entries) {
@@ -22886,7 +23176,7 @@ function scanComponentExports(dataDb) {
   }
   for (const dir of componentDirs) {
     const absDir = resolve32(projectRoot, dir);
-    if (!existsSync35(absDir)) continue;
+    if (!existsSync36(absDir)) continue;
     const files = walkDir2(absDir).filter((f2) => f2.endsWith(".tsx") || f2.endsWith(".ts"));
     for (const file of files) {
       const relPath = relative11(projectRoot, file);
@@ -22916,7 +23206,7 @@ function scanComponentExports(dataDb) {
       if (hasHandlers && exportMatch) {
         const componentName = exportMatch[1];
         const domain = inferDomain(relPath);
-        const subdomain = basename7(dirname16(relPath));
+        const subdomain = basename7(dirname17(relPath));
         const featureKey = `component.${subdomain}.${componentName.replace(/([A-Z])/g, "-$1").toLowerCase().replace(/^-/, "")}`;
         if (!annotations.some((a2) => a2.featureKey === featureKey)) {
           features.push({
@@ -23930,7 +24220,7 @@ var init_audit_trail = __esm({
 });
 
 // src/validation-engine.ts
-import { existsSync as existsSync36, readFileSync as readFileSync36 } from "fs";
+import { existsSync as existsSync37, readFileSync as readFileSync36 } from "fs";
 function p10(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -23961,7 +24251,7 @@ function validateFile(filePath, projectRoot) {
     });
     return checks;
   }
-  if (!existsSync36(absPath)) {
+  if (!existsSync37(absPath)) {
     checks.push({
       name: "file_exists",
       severity: "error",
@@ -24415,7 +24705,7 @@ var init_adr_generator = __esm({
 });
 
 // src/security-scorer.ts
-import { existsSync as existsSync37, readFileSync as readFileSync37 } from "fs";
+import { existsSync as existsSync38, readFileSync as readFileSync37 } from "fs";
 function p12(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
 }
@@ -24439,7 +24729,7 @@ function scoreFileSecurity(filePath, projectRoot) {
       }]
     };
   }
-  if (!existsSync37(absPath)) {
+  if (!existsSync38(absPath)) {
     return { riskScore: 0, findings: [] };
   }
   let source;
@@ -24733,7 +25023,7 @@ var init_security_scorer = __esm({
 });
 
 // src/dependency-scorer.ts
-import { existsSync as existsSync38, readFileSync as readFileSync38 } from "fs";
+import { existsSync as existsSync39, readFileSync as readFileSync38 } from "fs";
 import { resolve as resolve33 } from "path";
 function p13(baseName) {
   return `${getConfig().toolPrefix}_${baseName}`;
@@ -24767,7 +25057,7 @@ function calculateDepRisk(factors) {
 }
 function getInstalledPackages(projectRoot) {
   const pkgPath = resolve33(projectRoot, "package.json");
-  if (!existsSync38(pkgPath)) return /* @__PURE__ */ new Map();
+  if (!existsSync39(pkgPath)) return /* @__PURE__ */ new Map();
   try {
     const pkg = JSON.parse(readFileSync38(pkgPath, "utf-8"));
     const packages = /* @__PURE__ */ new Map();
@@ -25372,7 +25662,7 @@ var init_regression_detector = __esm({
 
 // src/knowledge-indexer.ts
 import { createHash as createHash9 } from "crypto";
-import { readFileSync as readFileSync39, readdirSync as readdirSync24, statSync as statSync14, existsSync as existsSync39 } from "fs";
+import { readFileSync as readFileSync39, readdirSync as readdirSync24, statSync as statSync14, existsSync as existsSync40 } from "fs";
 import { resolve as resolve34, relative as relative12, basename as basename8, extname as extname2 } from "path";
 function getKnowledgePaths() {
   const resolved = getResolvedPaths();
@@ -25680,11 +25970,11 @@ function indexAllKnowledge(db) {
     files.push(...memFiles);
   } catch {
   }
-  if (existsSync39(paths.plansDir)) {
+  if (existsSync40(paths.plansDir)) {
     const planFiles = discoverMarkdownFiles(paths.plansDir);
     files.push(...planFiles);
   }
-  if (existsSync39(paths.docsDir)) {
+  if (existsSync40(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -25727,7 +26017,7 @@ function indexAllKnowledge(db) {
     } catch {
     }
     for (const filePath of files) {
-      if (!existsSync39(filePath)) continue;
+      if (!existsSync40(filePath)) continue;
       const content = readFileSync39(filePath, "utf-8");
       const hash = hashContent2(content);
       const relPath = filePath.startsWith(paths.claudeDir) ? relative12(paths.claudeDir, filePath) : filePath.startsWith(paths.plansDir) ? "plans/" + relative12(paths.plansDir, filePath) : filePath.startsWith(paths.docsDir) ? "docs/" + relative12(paths.docsDir, filePath) : filePath.startsWith(paths.memoryDir) ? `memory/${relative12(paths.memoryDir, filePath)}` : basename8(filePath);
@@ -25826,6 +26116,21 @@ Rule: ${c2.rule}`,
         }
       }
     }
+    const customerRules = getConfig().governance_rules ?? [];
+    const insertCustomerRule = db.prepare(
+      `INSERT OR REPLACE INTO knowledge_rules (rule_id, rule_text, vr_type, reference_path, severity, source)
+       VALUES (?, ?, ?, ?, ?, 'customer-config')`
+    );
+    for (const rule of customerRules) {
+      const namespacedId = rule.id.startsWith("customer:") ? rule.id : `customer:${rule.id}`;
+      insertCustomerRule.run(
+        namespacedId,
+        `${rule.title}: ${rule.description}`,
+        rule.vr_type ?? "VR-CUSTOM",
+        rule.reference_path ?? null,
+        rule.severity?.toUpperCase() ?? "MEDIUM"
+      );
+    }
     stats.edgesCreated = buildCrossReferences(db);
     const finalNow = /* @__PURE__ */ new Date();
     const finalIso = finalNow.toISOString();
@@ -25848,10 +26153,10 @@ function isKnowledgeStale(db) {
     files.push(...discoverMarkdownFiles(paths.memoryDir));
   } catch {
   }
-  if (existsSync39(paths.plansDir)) {
+  if (existsSync40(paths.plansDir)) {
     files.push(...discoverMarkdownFiles(paths.plansDir));
   }
-  if (existsSync39(paths.docsDir)) {
+  if (existsSync40(paths.docsDir)) {
     const excludePatterns = getConfig().conventions?.excludePatterns ?? ["/ARCHIVE/", "/SESSION-HISTORY/"];
     const docsFiles = discoverMarkdownFiles(paths.docsDir).filter((f2) => !f2.includes("/plans/") && !excludePatterns.some((p19) => f2.includes(p19)));
     files.push(...docsFiles);
@@ -26968,176 +27273,6 @@ var init_knowledge_tools = __esm({
   }
 });
 
-// src/knowledge-db.ts
-import Database3 from "better-sqlite3";
-import { dirname as dirname17 } from "path";
-import { existsSync as existsSync41, mkdirSync as mkdirSync11 } from "fs";
-function getKnowledgeDb() {
-  const dbPath = getResolvedPaths().knowledgeDbPath;
-  const dir = dirname17(dbPath);
-  if (!existsSync41(dir)) {
-    mkdirSync11(dir, { recursive: true });
-  }
-  const db = new Database3(dbPath);
-  db.pragma("journal_mode = WAL");
-  db.pragma("foreign_keys = ON");
-  initKnowledgeSchema(db);
-  return db;
-}
-function initKnowledgeSchema(db) {
-  db.exec(`
-    -- Core document chunks (parsed from .claude/**/*.md)
-    CREATE TABLE IF NOT EXISTS knowledge_documents (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      file_path TEXT NOT NULL,
-      category TEXT NOT NULL,
-      title TEXT NOT NULL,
-      description TEXT,
-      content_hash TEXT NOT NULL,
-      indexed_at TEXT NOT NULL,
-      indexed_at_epoch INTEGER NOT NULL
-    );
-
-    CREATE UNIQUE INDEX IF NOT EXISTS idx_kd_filepath ON knowledge_documents(file_path);
-    CREATE INDEX IF NOT EXISTS idx_kd_category ON knowledge_documents(category);
-
-    -- Structured chunks within documents
-    CREATE TABLE IF NOT EXISTS knowledge_chunks (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      document_id INTEGER NOT NULL REFERENCES knowledge_documents(id) ON DELETE CASCADE,
-      chunk_type TEXT NOT NULL CHECK(chunk_type IN (
-        'section', 'table_row', 'code_block', 'rule', 'incident', 'pattern', 'command', 'mismatch'
-      )),
-      heading TEXT,
-      content TEXT NOT NULL,
-      line_start INTEGER,
-      line_end INTEGER,
-      metadata TEXT DEFAULT '{}'
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_kc_doc ON knowledge_chunks(document_id);
-    CREATE INDEX IF NOT EXISTS idx_kc_type ON knowledge_chunks(chunk_type);
-    CREATE INDEX IF NOT EXISTS idx_kc_heading ON knowledge_chunks(heading);
-
-    -- Canonical Rules index
-    CREATE TABLE IF NOT EXISTS knowledge_rules (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      rule_id TEXT UNIQUE NOT NULL,
-      rule_text TEXT NOT NULL,
-      vr_type TEXT,
-      reference_path TEXT,
-      severity TEXT DEFAULT 'HIGH',
-      prevention_summary TEXT
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_kr_id ON knowledge_rules(rule_id);
-
-    -- Verification Requirements index
-    CREATE TABLE IF NOT EXISTS knowledge_verifications (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      vr_type TEXT UNIQUE NOT NULL,
-      command TEXT NOT NULL,
-      expected TEXT NOT NULL,
-      use_when TEXT NOT NULL,
-      catches TEXT,
-      category TEXT
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_kv_type ON knowledge_verifications(vr_type);
-    CREATE INDEX IF NOT EXISTS idx_kv_category ON knowledge_verifications(category);
-
-    -- Incident index
-    CREATE TABLE IF NOT EXISTS knowledge_incidents (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      incident_num INTEGER UNIQUE NOT NULL,
-      date TEXT NOT NULL,
-      type TEXT NOT NULL,
-      gap_found TEXT NOT NULL,
-      prevention TEXT NOT NULL,
-      cr_added TEXT,
-      root_cause TEXT,
-      user_quote TEXT
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_ki_num ON knowledge_incidents(incident_num);
-    CREATE INDEX IF NOT EXISTS idx_ki_type ON knowledge_incidents(type);
-    CREATE INDEX IF NOT EXISTS idx_ki_cr ON knowledge_incidents(cr_added);
-
-    -- Schema mismatch quick lookup
-    -- P-H013 (plan-stage-c-high-batch): the source column no longer has a
-    -- SQL DEFAULT. Previously the value was a JS template-literal
-    -- interpolation baked into the customer SQLite at schema creation
-    -- time, so later config changes were ignored. Default is now applied
-    -- at INSERT time via getConfig().conventions.knowledgeSourceFiles[0]
-    -- in knowledge-indexer.ts -- a runtime config lookup that reflects
-    -- the customers current config.
-    CREATE TABLE IF NOT EXISTS knowledge_schema_mismatches (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      table_name TEXT NOT NULL,
-      wrong_column TEXT NOT NULL,
-      correct_column TEXT NOT NULL,
-      source TEXT NOT NULL
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_ksm_table ON knowledge_schema_mismatches(table_name);
-
-    -- Cross-reference graph
-    CREATE TABLE IF NOT EXISTS knowledge_edges (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      source_type TEXT NOT NULL,
-      source_id TEXT NOT NULL,
-      target_type TEXT NOT NULL,
-      target_id TEXT NOT NULL,
-      edge_type TEXT NOT NULL
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_ke_source ON knowledge_edges(source_type, source_id);
-    CREATE INDEX IF NOT EXISTS idx_ke_target ON knowledge_edges(target_type, target_id);
-    CREATE UNIQUE INDEX IF NOT EXISTS idx_ke_unique ON knowledge_edges(source_type, source_id, target_type, target_id, edge_type);
-
-    -- Staleness tracking
-    CREATE TABLE IF NOT EXISTS knowledge_meta (
-      key TEXT PRIMARY KEY,
-      value TEXT NOT NULL
-    );
-  `);
-  try {
-    db.exec(`
-      CREATE VIRTUAL TABLE IF NOT EXISTS knowledge_fts USING fts5(
-        heading, content, chunk_type, file_path
-      );
-
-      CREATE TRIGGER IF NOT EXISTS kc_fts_insert AFTER INSERT ON knowledge_chunks BEGIN
-        INSERT INTO knowledge_fts(rowid, heading, content, chunk_type, file_path)
-        SELECT new.id, new.heading, new.content, new.chunk_type, kd.file_path
-        FROM knowledge_documents kd WHERE kd.id = new.document_id;
-      END;
-
-      CREATE TRIGGER IF NOT EXISTS kc_fts_delete AFTER DELETE ON knowledge_chunks BEGIN
-        INSERT INTO knowledge_fts(knowledge_fts, rowid, heading, content, chunk_type, file_path)
-        SELECT 'delete', old.id, old.heading, old.content, old.chunk_type, kd.file_path
-        FROM knowledge_documents kd WHERE kd.id = old.document_id;
-      END;
-
-      CREATE TRIGGER IF NOT EXISTS kc_fts_update AFTER UPDATE ON knowledge_chunks BEGIN
-        INSERT INTO knowledge_fts(knowledge_fts, rowid, heading, content, chunk_type, file_path)
-        SELECT 'delete', old.id, old.heading, old.content, old.chunk_type, kd.file_path
-        FROM knowledge_documents kd WHERE kd.id = old.document_id;
-        INSERT INTO knowledge_fts(rowid, heading, content, chunk_type, file_path)
-        SELECT new.id, new.heading, new.content, new.chunk_type, kd.file_path
-        FROM knowledge_documents kd WHERE kd.id = new.document_id;
-      END;
-    `);
-  } catch {
-  }
-}
-var init_knowledge_db = __esm({
-  "src/knowledge-db.ts"() {
-    "use strict";
-    init_config();
-  }
-});
-
 // src/python/domain-enforcer.ts
 function classifyPythonFileDomain(file) {
   const config = getConfig();
@@ -27946,29 +28081,37 @@ function assertCodegraphDb(codegraphDb, toolName) {
   }
   return codegraphDb;
 }
-async function handleToolCall(name, args2, dataDb, codegraphDb) {
+async function handleToolCall(name, args2, dataDb, codegraphDb, memoryDbCache, knowledgeDbCache) {
   const userTier = await getCurrentTier();
   const requiredTier = getToolTier(name);
   if (!isToolAllowed(name, userTier)) {
     return text17(`This tool requires ${requiredTier} tier. Current tier: ${userTier}. Upgrade at https://massu.ai/pricing`);
   }
   const pfx = prefix2();
+  async function withMemDb(fn) {
+    if (memoryDbCache) return fn(memoryDbCache);
+    const db = getMemoryDb();
+    try {
+      return await fn(db);
+    } finally {
+      db.close();
+    }
+  }
+  async function withKnowledgeDb(fn) {
+    if (knowledgeDbCache) return fn(knowledgeDbCache);
+    const db = getKnowledgeDb();
+    try {
+      return await fn(db);
+    } finally {
+      db.close();
+    }
+  }
   try {
     if (name.startsWith(pfx + "_memory_")) {
-      const memDb = getMemoryDb();
-      try {
-        return handleMemoryToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleMemoryToolCall(name, args2, memDb));
     }
     if (isObservabilityTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleObservabilityToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleObservabilityToolCall(name, args2, memDb));
     }
     if (name.startsWith(pfx + "_docs_")) {
       return handleDocsToolCall(name, args2);
@@ -27977,92 +28120,37 @@ async function handleToolCall(name, args2, dataDb, codegraphDb) {
       return handleSentinelToolCall(name, args2, assertDataDb(dataDb, name));
     }
     if (isAnalyticsTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleAnalyticsToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleAnalyticsToolCall(name, args2, memDb));
     }
     if (isCostTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleCostToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleCostToolCall(name, args2, memDb));
     }
     if (isPromptTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handlePromptToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handlePromptToolCall(name, args2, memDb));
     }
     if (isAuditTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleAuditToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleAuditToolCall(name, args2, memDb));
     }
     if (isValidationTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleValidationToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleValidationToolCall(name, args2, memDb));
     }
     if (isAdrTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleAdrToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleAdrToolCall(name, args2, memDb));
     }
     if (isSecurityTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleSecurityToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleSecurityToolCall(name, args2, memDb));
     }
     if (isDependencyTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleDependencyToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleDependencyToolCall(name, args2, memDb));
     }
     if (isTeamTool(name) && isCloudFeatureAvailable()) {
-      const memDb = getMemoryDb();
-      try {
-        return handleTeamToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleTeamToolCall(name, args2, memDb));
     }
     if (isRegressionTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return handleRegressionToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleRegressionToolCall(name, args2, memDb));
     }
     if (isKnowledgeTool(name)) {
-      const knowledgeDb = getKnowledgeDb();
-      try {
-        return handleKnowledgeToolCall(name, args2, knowledgeDb);
-      } finally {
-        knowledgeDb.close();
-      }
+      return withKnowledgeDb((kdb) => handleKnowledgeToolCall(name, args2, kdb));
     }
     if (isPythonTool(name)) {
       const pyDataDb = assertDataDb(dataDb, name);
@@ -28070,12 +28158,7 @@ async function handleToolCall(name, args2, dataDb, codegraphDb) {
       return handlePythonToolCall(name, args2, pyDataDb);
     }
     if (isLicenseTool(name)) {
-      const memDb = getMemoryDb();
-      try {
-        return await handleLicenseToolCall(name, args2, memDb);
-      } finally {
-        memDb.close();
-      }
+      return withMemDb((memDb) => handleLicenseToolCall(name, args2, memDb));
     }
     const baseName = stripPrefix3(name);
     switch (baseName) {
@@ -28897,10 +28980,14 @@ var init_tool_db_needs = __esm({
 function createDispatcher(options) {
   let codegraphDbCache = null;
   let dataDbCache = null;
+  let memoryDbCache = null;
+  let knowledgeDbCache = null;
   function resolveDbsForTool(toolName) {
     const needs = getToolDbNeeds(toolName, getConfig().toolPrefix);
     let dataDbResolved;
     let codegraphDbResolved;
+    let memoryDbResolved;
+    let knowledgeDbResolved;
     if (needs.includes("data")) {
       if (!dataDbCache) dataDbCache = getDataDb();
       dataDbResolved = dataDbCache;
@@ -28909,7 +28996,21 @@ function createDispatcher(options) {
       if (!codegraphDbCache) codegraphDbCache = getCodeGraphDb();
       codegraphDbResolved = codegraphDbCache;
     }
-    return { needs, dataDb: dataDbResolved, codegraphDb: codegraphDbResolved };
+    if (needs.includes("memory")) {
+      if (!memoryDbCache) memoryDbCache = getMemoryDb();
+      memoryDbResolved = memoryDbCache;
+    }
+    if (needs.includes("knowledge")) {
+      if (!knowledgeDbCache) knowledgeDbCache = getKnowledgeDb();
+      knowledgeDbResolved = knowledgeDbCache;
+    }
+    return {
+      needs,
+      dataDb: dataDbResolved,
+      codegraphDb: codegraphDbResolved,
+      memoryDb: memoryDbResolved,
+      knowledgeDb: knowledgeDbResolved
+    };
   }
   async function handleRequest(request) {
     const { method, params, id } = request;
@@ -28939,8 +29040,8 @@ function createDispatcher(options) {
         const toolName = params?.name ?? "";
         const toolArgs = params?.arguments ?? {};
         try {
-          const { dataDb, codegraphDb } = resolveDbsForTool(toolName);
-          const result = await handleToolCall(toolName, toolArgs, dataDb, codegraphDb);
+          const { dataDb, codegraphDb, memoryDb, knowledgeDb } = resolveDbsForTool(toolName);
+          const result = await handleToolCall(toolName, toolArgs, dataDb, codegraphDb, memoryDb, knowledgeDb);
           return { jsonrpc: "2.0", id: id ?? null, result };
         } catch (err) {
           if (err instanceof CodegraphDbNotInitializedError) {
@@ -29032,6 +29133,14 @@ function createDispatcher(options) {
       dataDbCache.close();
       dataDbCache = null;
     }
+    if (memoryDbCache) {
+      memoryDbCache.close();
+      memoryDbCache = null;
+    }
+    if (knowledgeDbCache) {
+      knowledgeDbCache.close();
+      knowledgeDbCache = null;
+    }
   }
   return { handleRequest, processLine, closeCachedDbs };
 }
@@ -29039,6 +29148,8 @@ var init_server_dispatch = __esm({
   "src/server-dispatch.ts"() {
     "use strict";
     init_db();
+    init_memory_db();
+    init_knowledge_db();
     init_config();
     init_tools();
     init_tool_db_needs();
@@ -29646,6 +29757,15 @@ async function main() {
       break;
     }
     default: {
+      if (subcommand && !subcommand.startsWith("-")) {
+        process.stderr.write(
+          `Error: Unknown subcommand '${subcommand}'.
+Run \`npx @massu/core --help\` for the list of available subcommands.
+To start the MCP server, run without a subcommand (e.g. \`npx @massu/core\`).
+`
+        );
+        process.exit(2);
+      }
       await Promise.resolve().then(() => (init_server(), server_exports));
     }
   }