@open-everywhere/core 0.1.0

package/dist/agent/memory/dream/skill-proposal-pr.js

@@ -0,0 +1,245 @@
+// A repeated workflow becomes a pull request on the deployer's config repo, never a push: the file is written on a proposal branch and this module has no merge call, so merging is the human decision that arms the skill.
+// It is off until a deployment arms `memory.skillProposalPr`, and the audit row stays taint-clean — the signature digest and counts, never the member's request or a correction's words.
+import { getConfig } from "../../access/config.js";
+import { appendAudit, readAudit } from "../../audit/audit.js";
+import { getConfigPrProvider } from "../../credentials/config-pr.js";
+import { parseFrontmatter } from "../../plugins/extract.js";
+import { isSafeBranchName, SKILL_ROOTS } from "../../scm/git.js";
+import { isSafeSkillName } from "../../scm/repo-skills.js";
+import { getSettings } from "../../settings/settings.js";
+import { CORRECTIONS_HEADING, harvestCorrections, MAX_CORRECTIONS, renderCorrections } from "./correction.js";
+import { DREAM_ACTOR } from "./proposal.js";
+import { signatureDigest } from "./recurrence.js";
+/** The audit action one proposal-PR attempt writes. Also the key the correction loop reads back. */
+export const SKILL_PROPOSAL_PR_ACTION = "memory.skill_proposal_pr";
+/** Branch prefix for a proposal head. Deterministic, so a re-proposal updates its own PR. */
+const SKILL_PROPOSAL_BRANCH_PREFIX = "skill-proposal/";
+const MAX_PRIOR_PROPOSAL_PRS = 3;
+/**
+ * Keyed on scope AND signature. On the signature alone the branch was a collision site: the same workflow recurring in a second silo landed on the first silo's open pull request and rewrote its file, deleting a correction a person had left there.
+ * The branch is a digest, so a member's words never reach a ref name.
+ */
+export function skillProposalBranch(scope, signature) {
+    // Joined on a byte neither half can hold: a separator either half could contain makes ("a", "b c") and ("a b", "c") the same key.
+    return `${SKILL_PROPOSAL_BRANCH_PREFIX}${signatureDigest(`${scope}\u0000${signature}`).slice(0, 16)}`;
+}
+/** Where a repo-shipped skill lives — the same root `checkout_repo` discovers skills under. */
+export function skillProposalPath(name) {
+    return `${SKILL_ROOTS[0]}/${name}/SKILL.md`;
+}
+/** The skill name from the sketch's own frontmatter, or null. Null is a refusal to guess: a name that fails the skill-name rule must not become a path, because the file would never arm and the pull request would ask a human to merge something inert. */
+export function skillProposalName(markdown) {
+    const raw = parseFrontmatter(markdown).data.name;
+    const name = typeof raw === "string" ? raw.trim() : "";
+    return name && isSafeSkillName(name) ? name : null;
+}
+export function skillProposalContent(sketch, corrections) {
+    const section = renderCorrections(corrections);
+    const body = sketch.endsWith("\n") ? sketch : `${sketch}\n`;
+    return section ? `${body}\n${section}\n` : body;
+}
+function skillProposalTitle(name) {
+    return `Skill proposal: ${name}`;
+}
+/** Code-rendered from the frozen proposal, never model prose. */
+function skillProposalBody(p, name, corrections, refused) {
+    const count = typeof p.detail?.["count"] === "number" ? p.detail["count"] : undefined;
+    const request = typeof p.detail?.["request"] === "string" ? p.detail["request"] : undefined;
+    const lines = [
+        `The dream cycle saw this workflow recur${count !== undefined ? ` **${count} times**` : ""} in \`${p.scope}\` and proposes capturing it as the skill \`${name}\`.`,
+        "",
+        "**Merging is what arms it.** Until then nothing changes: the agent does not follow this file. A skill is a procedure the agent loads and FOLLOWS, so read the whole body before you merge.",
+        "",
+        "Closing this pull request declines this draft. It is not a permanent no: if the same workflow recurs in this same place again, the cycle reopens this pull request with a fresh draft. Say why in a comment and the next draft will carry it.",
+        "",
+    ];
+    if (request !== undefined) {
+        lines.push("The request line that fingerprinted the workflow is quoted in the file, because it is what a reviewer needs to judge whether the skill matches the ask. It is a member's own words, held to the same rule as the proposal review queue.", "");
+    }
+    if (corrections.length > 0) {
+        lines.push(`**${corrections.length} correction(s) from earlier review are carried into this proposal**, under "${CORRECTIONS_HEADING}" in the file. Each names the person who wrote it. They are review input, not agreed copy — fold them in before you merge.`, "");
+    }
+    if (refused > 0) {
+        lines.push(`${refused} other comment(s) on the earlier proposal were REFUSED as corrections: their authors hold no standing in this repository, or they were written by a machine. They are still on that thread to read.`, "");
+    }
+    lines.push("---", "Opened by the Mode-1 dream cycle (`packages/core/agent/memory/dream/skill-proposal-pr.ts`). The cycle never merges: this branch is the only thing it can write, and a person decides the rest.");
+    return lines.join("\n");
+}
+/**
+ * Filtering on the signature as well as the scope is not an optimisation: on the scope alone a correction from one workflow's proposal would be carried into a different workflow's skill file, with its author's name on guidance they never gave.
+ * Fail-soft to nothing known: an unreadable audit store costs the corrections and the replay guard, never the proposal.
+ */
+export async function proposalPrHistory(org, scope, sigSha, delivery, max = MAX_PRIOR_PROPOSAL_PRS) {
+    try {
+        // The scope is part of the QUERY, not a filter over the result: `limit` caps the newest rows the store returns, so an org-wide read lets a busy org push this scope's prior proposal out of the window.
+        // The next proposal would then carry no corrections and the row would say `corrections: 0`, a false claim that nobody objected.
+        const rows = await readAudit({ org, workspace: scope, action: SKILL_PROPOSAL_PR_ACTION, limit: 100 });
+        const priorPrs = [];
+        let attemptedForDelivery = false;
+        for (const row of rows) {
+            if (row.detail?.["scope"] !== scope || row.detail["sigSha"] !== sigSha)
+                continue;
+            if (delivery !== undefined && row.detail["delivery"] === delivery)
+                attemptedForDelivery = true;
+            const pr = row.detail["pr"];
+            if (typeof pr !== "number" || priorPrs.includes(pr) || priorPrs.length >= max)
+                continue;
+            priorPrs.push(pr);
+        }
+        return { priorPrs, attemptedForDelivery };
+    }
+    catch {
+        return { priorPrs: [], attemptedForDelivery: false };
+    }
+}
+/**
+ * Read the corrections people left on earlier proposals in this scope. Returns `null` corrections
+ * when the channel could not be read at all — a provider without `listPrFeedback`, or a throwing
+ * read — so the caller can audit "could not ask" rather than record a false "nobody objected".
+ */
+async function readCorrections(provider, repo, token, prs) {
+    if (provider.listPrFeedback === undefined)
+        return { corrections: null, refused: 0 };
+    const corrections = [];
+    let refused = 0;
+    for (const number of prs) {
+        let feedback;
+        try {
+            feedback = await provider.listPrFeedback({ repo, number, token });
+        }
+        catch {
+            // Unreadable is unreadable for the WHOLE read, and the partial refusal count goes with it: a
+            // proposal must not disclose "3 comments were refused" from a set it could not finish reading.
+            return { corrections: null, refused: 0 };
+        }
+        const harvest = harvestCorrections(feedback);
+        corrections.push(...harvest.corrections);
+        refused += harvest.refused;
+    }
+    // The cap again, over the CONCATENATION. `harvestCorrections` bounds one pull request; this bounds
+    // the proposal, which is what `MAX_CORRECTIONS` names. Without it three prior proposals put 24
+    // bodies into a committed file.
+    return { corrections: corrections.slice(0, MAX_CORRECTIONS), refused };
+}
+/**
+ * NEVER THROWS on a configuration problem: an unarmed deployment, no config repo and an unusable skill name all return `opened: false` with a reason, because this runs at a turn edge behind a member's own request.
+ * A provider failure does throw, because a silent swallow would hide a broken credential forever.
+ */
+export async function openSkillProposalPr(org, proposal, deps = {}) {
+    const none = { corrections: 0, refusedCorrections: 0 };
+    const armed = deps.armed ?? armedByConfig();
+    if (!armed)
+        return { opened: false, skipped: "memory.skillProposalPr is off — the proposal was recorded, no PR opened", ...none };
+    const sketch = proposal.after;
+    if (!sketch)
+        return { opened: false, skipped: "proposal carries no SKILL.md body", ...none };
+    const name = skillProposalName(sketch);
+    if (name === null)
+        return { opened: false, skipped: "proposal has no usable skill name in its frontmatter", ...none };
+    // The repo, base branch and credential are the access-request flow's own. `getConfig` throws on a partial boot, and that is unconfigured-so-skip rather than a crash.
+    let cfg;
+    try {
+        cfg = getConfig().loadAccessRequests?.() ?? null;
+    }
+    catch {
+        cfg = null;
+    }
+    const repo = deps.repo ?? cfg?.configRepo;
+    const base = deps.base ?? cfg?.configBase ?? "main";
+    if (!repo)
+        return { opened: false, skipped: "no config repo configured (accessRequests.configRepo) — the proposal was recorded, no PR opened", ...none };
+    const signature = typeof proposal.detail?.["signature"] === "string" ? proposal.detail["signature"] : proposal.summary;
+    const sigSha = signatureDigest(signature);
+    const branch = skillProposalBranch(proposal.scope, signature);
+    if (!isSafeBranchName(branch)) {
+        // The branch is a hex digest behind a fixed prefix, so this cannot fire on member text. It is the
+        // same up-front guard the credential-binding PR keeps for the same reason: a ref name reaches a
+        // shell in some providers, and "it can't happen" is not a check.
+        throw new Error(`unsafe skill-proposal branch name "${branch}"`);
+    }
+    // ONE audit scan, BEFORE any credential or network work: it answers both "has this delivery already
+    // been attempted?" (the replay guard) and "which earlier proposals of this workflow carry
+    // corrections?". The order matters — a replayed body must cost a store read, not a GitHub write.
+    const history = await proposalPrHistory(org, proposal.scope, sigSha, deps.delivery);
+    if (history.attemptedForDelivery) {
+        return { opened: false, skipped: `already attempted for delivery ${deps.delivery} — a replayed hook body opens no second PR`, ...none };
+    }
+    const provider = deps.provider ?? getConfigPrProvider();
+    const token = await provider.resolveWriteToken(repo);
+    const prs = deps.priorPrs ?? history.priorPrs;
+    const { corrections, refused } = await readCorrections(provider, repo, token, prs);
+    const carried = corrections ?? [];
+    // Reuse is the revision path: a corrected proposal re-commits on the same branch, so one workflow is one pull request rather than a pile.
+    const existingBranchSha = await provider.getBranchSha({ repo, branch, token });
+    if (existingBranchSha === null) {
+        const baseSha = await provider.getBranchSha({ repo, branch: base, token });
+        if (baseSha === null)
+            throw new Error(`config repo ${repo} has no base branch "${base}" — check accessRequests.configBase.`);
+        await provider.ensureBranch({ repo, branch, sha: baseSha, token });
+    }
+    const path = skillProposalPath(name);
+    const content = skillProposalContent(sketch, carried);
+    const existing = await provider.getFile({ repo, path, branch, token });
+    if (existing?.content !== content) {
+        await provider.putFile({
+            repo,
+            path,
+            content,
+            message: `skill proposal: ${name}`,
+            branch,
+            token,
+            committer: provider.committer(),
+            ...(existing?.sha ? { sha: existing.sha } : {}),
+        });
+    }
+    const pr = await provider.openOrReopenPr({
+        repo,
+        head: branch,
+        base,
+        title: skillProposalTitle(name),
+        body: skillProposalBody(proposal, name, carried, refused),
+        token,
+    });
+    await appendAudit({
+        org,
+        platform: "memory",
+        workspace: proposal.scope,
+        principalId: DREAM_ACTOR,
+        action: SKILL_PROPOSAL_PR_ACTION,
+        // Taint-clean: the digest, never the signature; counts, never a correction's words.
+        detail: {
+            scope: proposal.scope,
+            repo,
+            branch,
+            pr: pr.number,
+            updated: pr.updated,
+            reopened: pr.reopened,
+            sigSha,
+            ...(deps.delivery !== undefined ? { delivery: deps.delivery } : {}),
+            ...(typeof proposal.detail?.["count"] === "number" ? { count: proposal.detail["count"] } : {}),
+            corrections: corrections === null ? null : corrections.length,
+            refusedCorrections: refused,
+        },
+    });
+    return {
+        opened: true,
+        url: pr.url,
+        number: pr.number,
+        repo,
+        branch,
+        updated: pr.updated,
+        reopened: pr.reopened,
+        corrections: corrections === null ? null : corrections.length,
+        refusedCorrections: refused,
+    };
+}
+/** `memory.skillProposalPr`, read per call (never cached — settings resolve after registration). */
+function armedByConfig() {
+    try {
+        return getSettings().memory.skillProposalPr;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=skill-proposal-pr.js.map

package/dist/agent/memory/dream/skill-proposal-pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-proposal-pr.js","sourceRoot":"","sources":["../../../../agent/memory/dream/skill-proposal-pr.ts"],"names":[],"mappings":"AAAA,4NAA4N;AAC5N,yLAAyL;AAEzL,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAyB,MAAM,gCAAgC,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,eAAe,EAAE,iBAAiB,EAAmB,MAAM,iBAAiB,CAAC;AAC/H,OAAO,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,oGAAoG;AACpG,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE,6FAA6F;AAC7F,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AAEvD,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAmCjC;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,SAAiB;IAClE,kIAAkI;IAClI,OAAO,GAAG,4BAA4B,GAAG,eAAe,CAAC,GAAG,KAAK,SAAS,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACxG,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC;AAC9C,CAAC;AAED,6PAA6P;AAC7P,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACjD,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,OAAO,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAkC;IACrF,MAAM,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC;IAC5D,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,mBAAmB,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,CAAW,EAAE,IAAY,EAAE,WAAkC,EAAE,OAAe;IACvG,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,MAAM,KAAK,GAAG;QACZ,0CAA0C,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,+CAA+C,IAAI,KAAK;QAClK,EAAE;QACF,4LAA4L;QAC5L,EAAE;QACF,+OAA+O;QAC/O,EAAE;KACH,CAAC;IACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CACR,yOAAyO,EACzO,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CACR,KAAK,WAAW,CAAC,MAAM,+EAA+E,mBAAmB,4HAA4H,EACrP,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,qMAAqM,EAC/M,EAAE,CACH,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,KAAK,EACL,gMAAgM,CACjM,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,KAAa,EACb,MAAc,EACd,QAAiB,EACjB,GAAG,GAAW,sBAAsB;IAEpC,IAAI,CAAC;QACH,wMAAwM;QACxM,gIAAgI;QAChI,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACtG,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,oBAAoB,GAAG,KAAK,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM;gBAAE,SAAS;YACjF,IAAI,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ;gBAAE,oBAAoB,GAAG,IAAI,CAAC;YAC/F,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;gBAAE,SAAS;YACxF,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAC5B,QAA0B,EAC1B,IAAY,EACZ,KAAa,EACb,GAAsB;IAEtB,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACpF,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,MAAM,IAAI,GAAG,EAAE,CAAC;QACzB,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,+FAA+F;YAC/F,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC3C,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC7C,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACzC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAC7B,CAAC;IACD,mGAAmG;IACnG,+FAA+F;IAC/F,gCAAgC;IAChC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAW,EACX,QAAkB,EAClB,IAAI,GAAwB,EAAE;IAE9B,MAAM,IAAI,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAW,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,yEAAyE,EAAE,GAAG,IAAI,EAAE,CAAC;IAElI,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mCAAmC,EAAE,GAAG,IAAI,EAAE,CAAC;IAC7F,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,sDAAsD,EAAE,GAAG,IAAI,EAAE,CAAC;IAEtH,sKAAsK;IACtK,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,EAAE,CAAC,kBAAkB,EAAE,EAAE,IAAI,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,UAAU,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,UAAU,IAAI,MAAM,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,iGAAiG,EAAE,GAAG,IAAI,EAAE,CAAC;IAEzJ,MAAM,SAAS,GAAG,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IACnI,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,kGAAkG;QAClG,gGAAgG;QAChG,iEAAiE;QACjE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,oGAAoG;IACpG,0FAA0F;IAC1F,iGAAiG;IACjG,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAkC,IAAI,CAAC,QAAQ,4CAA4C,EAAE,GAAG,IAAI,EAAE,CAAC;IAC1I,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAErD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC9C,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,WAAW,IAAI,EAAE,CAAC;IAElC,0IAA0I;IAC1I,MAAM,iBAAiB,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,IAAI,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,wBAAwB,IAAI,sCAAsC,CAAC,CAAC;QAC7H,MAAM,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,IAAI,QAAQ,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,OAAO,CAAC;YACrB,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,OAAO,EAAE,mBAAmB,IAAI,EAAE;YAClC,MAAM;YACN,KAAK;YACL,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE;YAC/B,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC;QACvC,IAAI;QACJ,IAAI,EAAE,MAAM;QACZ,IAAI;QACJ,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC;QAC/B,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;QACzD,KAAK;KACN,CAAC,CAAC;IAEH,MAAM,WAAW,CAAC;QAChB,GAAG;QACH,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,QAAQ,CAAC,KAAK;QACzB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,wBAAwB;QAChC,oFAAoF;QACpF,MAAM,EAAE;YACN,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI;YACJ,MAAM;YACN,EAAE,EAAE,EAAE,CAAC,MAAM;YACb,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,WAAW,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM;YAC7D,kBAAkB,EAAE,OAAO;SAC5B;KACF,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,EAAE,CAAC,GAAG;QACX,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI;QACJ,MAAM;QACN,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,QAAQ,EAAE,EAAE,CAAC,QAAQ;QACrB,WAAW,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM;QAC7D,kBAAkB,EAAE,OAAO;KAC5B,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/agent/memory/dream/supersede-apply.d.ts

@@ -0,0 +1,40 @@
+import type { MemoryFiles } from "../store.js";
+import type { MemoryOp } from "./ops.js";
+/** Why an approved supersede did not change the file. Every arm is a DECLINE, never a partial write. */
+export type SupersedeDeclineReason = "wrong-kind" | "malformed-op" | "missing-file" | "outdated-bullet-gone" | "current-bullet-gone" | "no-section";
+export type SupersedeApplyResult = {
+    readonly applied: true;
+    readonly files: MemoryFiles;
+    readonly superseded: string;
+} | {
+    readonly applied: false;
+    readonly reason: SupersedeDeclineReason;
+};
+/**
+ * Apply one approved `supersede` op to `files`.
+ *
+ * The op's `before` carries the pair in the order `selectCandidates` built it — `[outdated,
+ * current]`, oldest first — and `after` carries the survivor line the judge chose (with any
+ * provenance carrier `tidySiloJudged` conserved onto it).
+ *
+ * TWO EDITS, AND THE ORDER IS LOAD-BEARING:
+ *   1. remove the CURRENT line, then
+ *   2. replace the OUTDATED line in place with the survivor.
+ * Doing it the other way round can delete the wrong line. Step 2 usually writes the current line's
+ * own text into the outdated line's slot, so a later step 1 searching for that text would match the
+ * line just written — it comes first in the file — and remove the survivor while leaving the
+ * duplicate. Removing first means the only line carrying that text is the real one.
+ *
+ * 🔴 BOTH LINES ARE MATCHED BY BYTE EQUALITY, never by similarity. `supersedeUnderSection`'s own
+ * contract demands it ("that predicate decides a DELETION, so it must be an exact identity the
+ * caller already holds, never a similarity score"), and OPE-1995 is the ticket that measured what a
+ * score does here: the false-positive class reaches 1.00 on this repo's kernel. The exact bytes are
+ * what the judge was shown and what the human approved, so they are the only safe key.
+ *
+ * ANY MISMATCH DECLINES WHOLE. The file may have moved on between the proposal and the approval — a
+ * seat may have rewritten or deleted either line. A partial apply would then delete one statement
+ * and keep a stale one, which is worse than doing nothing, so every failure returns `applied: false`
+ * with the input untouched and a human re-reviews against the current file.
+ */
+export declare function applySupersedeOp(files: MemoryFiles, op: MemoryOp): SupersedeApplyResult;
+//# sourceMappingURL=supersede-apply.d.ts.map

package/dist/agent/memory/dream/supersede-apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supersede-apply.d.ts","sourceRoot":"","sources":["../../../../agent/memory/dream/supersede-apply.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC,wGAAwG;AACxG,MAAM,MAAM,sBAAsB,GAC9B,YAAY,GACZ,cAAc,GACd,cAAc,GACd,sBAAsB,GACtB,qBAAqB,GACrB,YAAY,CAAC;AAEjB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,GAAG,oBAAoB,CAoCvF"}

package/dist/agent/memory/dream/supersede-apply.js

@@ -0,0 +1,78 @@
+// What an APPROVED `supersede` proposal does to a silo's markdown (OPE-1995). Pure — no I/O, no
+// clock, no store — so the reviewer-facing half of the feature can be proven offline.
+//
+// 🔴 NOTHING IN THE DREAM CYCLE CALLS THIS, AND THAT IS THE DESIGN. `supersede` is a DESTRUCTIVE
+// kind (dream/ops.ts): the cycle DETECTS it, a judge CONFIRMS it, and `recordProposal` files it for
+// a human. This module is the step that runs only after that human approves. It is exported rather
+// than inlined into a future approval route so the delete can be tested against real markdown now,
+// instead of arriving untested inside whatever lifecycle eventually calls it.
+//
+// THERE IS NO SUCH LIFECYCLE YET — `dream/proposal.ts` says so in its own header ("no accept/reject
+// lifecycle yet — the store has no status column"). Adding one is a schema change and a separate
+// review, so it is not in this diff. What IS in this diff is the apply, written to the primitive's
+// contract, so the lifecycle lands on a function with tests rather than the other way round.
+import { removeBulletLineWhere, sectionTitleOfBullet, supersedeUnderSection } from "../markdown.js";
+/**
+ * Apply one approved `supersede` op to `files`.
+ *
+ * The op's `before` carries the pair in the order `selectCandidates` built it — `[outdated,
+ * current]`, oldest first — and `after` carries the survivor line the judge chose (with any
+ * provenance carrier `tidySiloJudged` conserved onto it).
+ *
+ * TWO EDITS, AND THE ORDER IS LOAD-BEARING:
+ *   1. remove the CURRENT line, then
+ *   2. replace the OUTDATED line in place with the survivor.
+ * Doing it the other way round can delete the wrong line. Step 2 usually writes the current line's
+ * own text into the outdated line's slot, so a later step 1 searching for that text would match the
+ * line just written — it comes first in the file — and remove the survivor while leaving the
+ * duplicate. Removing first means the only line carrying that text is the real one.
+ *
+ * 🔴 BOTH LINES ARE MATCHED BY BYTE EQUALITY, never by similarity. `supersedeUnderSection`'s own
+ * contract demands it ("that predicate decides a DELETION, so it must be an exact identity the
+ * caller already holds, never a similarity score"), and OPE-1995 is the ticket that measured what a
+ * score does here: the false-positive class reaches 1.00 on this repo's kernel. The exact bytes are
+ * what the judge was shown and what the human approved, so they are the only safe key.
+ *
+ * ANY MISMATCH DECLINES WHOLE. The file may have moved on between the proposal and the approval — a
+ * seat may have rewritten or deleted either line. A partial apply would then delete one statement
+ * and keep a stale one, which is worse than doing nothing, so every failure returns `applied: false`
+ * with the input untouched and a human re-reviews against the current file.
+ */
+export function applySupersedeOp(files, op) {
+    if (op.kind !== "supersede")
+        return { applied: false, reason: "wrong-kind" };
+    const pair = op.before?.split("\n") ?? [];
+    const survivor = op.after;
+    if (pair.length !== 2 || survivor === undefined || survivor.trim().length === 0) {
+        return { applied: false, reason: "malformed-op" };
+    }
+    const [outdatedRaw, currentRaw] = pair;
+    const outdated = outdatedRaw.replace(/[ \t]+$/, "");
+    const current = currentRaw.replace(/[ \t]+$/, "");
+    const content = files[op.file];
+    if (content === undefined)
+        return { applied: false, reason: "missing-file" };
+    // Both lines are checked against the file BEFORE either edit, so a decline never leaves a
+    // half-applied file behind.
+    const lines = content.split("\n").map((l) => l.replace(/[ \t]+$/, ""));
+    if (!lines.includes(outdated))
+        return { applied: false, reason: "outdated-bullet-gone" };
+    if (!lines.includes(current))
+        return { applied: false, reason: "current-bullet-gone" };
+    // The section is read from the ORIGINAL content: removing the current line first cannot move the
+    // outdated line across a heading, but reading it here keeps the lookup independent of edit order.
+    const section = sectionTitleOfBullet(content, outdated);
+    if (section === null)
+        return { applied: false, reason: "no-section" };
+    const withoutCurrent = removeBulletLineWhere(content, (line) => line === current);
+    if (!withoutCurrent.removed)
+        return { applied: false, reason: "current-bullet-gone" };
+    const replaced = supersedeUnderSection(withoutCurrent.content, section, survivor, (existing) => existing === outdated);
+    // `supersedeUnderSection` APPENDS when its predicate matches nothing, which would add a line
+    // instead of replacing one. The membership check above makes that unreachable, and this guard
+    // keeps it unreachable if the section lookup and the predicate ever disagree.
+    if (replaced.superseded === null)
+        return { applied: false, reason: "outdated-bullet-gone" };
+    return { applied: true, files: { ...files, [op.file]: replaced.content }, superseded: replaced.superseded };
+}
+//# sourceMappingURL=supersede-apply.js.map

package/dist/agent/memory/dream/supersede-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supersede-apply.js","sourceRoot":"","sources":["../../../../agent/memory/dream/supersede-apply.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,sFAAsF;AACtF,EAAE;AACF,iGAAiG;AACjG,oGAAoG;AACpG,mGAAmG;AACnG,mGAAmG;AACnG,8EAA8E;AAC9E,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,mGAAmG;AACnG,6FAA6F;AAE7F,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAiBpG;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAkB,EAAE,EAAY;IAC/D,IAAI,EAAE,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAE7E,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAE7E,0FAA0F;IAC1F,4BAA4B;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACzF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEvF,iGAAiG;IACjG,kGAAkG;IAClG,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAEtE,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IAClF,IAAI,CAAC,cAAc,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEtF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACvH,6FAA6F;IAC7F,8FAA8F;IAC9F,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAE5F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;AAC9G,CAAC"}

package/dist/agent/memory/dream/tidy.d.ts

@@ -0,0 +1,60 @@
+import type { MemoryFiles } from "../store.js";
+import { type MemoryOp } from "./ops.js";
+import { type NodeSalience } from "./salience.js";
+import { type CandidateOptions } from "./candidates.js";
+import type { DreamJudge } from "./judge.js";
+export interface TidyOptions {
+    /** Clock for staleness detection (injected for tests). Defaults to now. */
+    readonly now?: Date;
+    /** Dated bullets older than this are flagged stale. Default 180. */
+    readonly staleDays?: number;
+    /** Word-overlap ≥ this flags a consolidation candidate. Default 0.7. */
+    readonly consolidateThreshold?: number;
+    /**
+     * Token overlap at or above this reads a `stale`/`contradiction`/`supersede` survivor as a RE-TYPING of the marked bullet, so the disclosure is conserved onto it (OPE-1444).
+     * Default `RESTATEMENT_THRESHOLD` (dream/ops.ts). {@link tidySilo}, the v1 path, ignores this field.
+     */
+    readonly restatementThreshold?: number;
+}
+export interface TidyResult {
+    /** The file set after the SAFE auto-applies (write this back). */
+    readonly files: MemoryFiles;
+    readonly applied: readonly MemoryOp[];
+    /** DESTRUCTIVE ops that were DETECTED but NOT applied — record these as proposals. */
+    readonly proposals: readonly MemoryOp[];
+    /** Node salience over the tidied files (well-connected = higher), for diagnostics/UX. */
+    readonly salience: readonly NodeSalience[];
+    /** True when the safe applies changed the files (skip the write if false). */
+    readonly changed: boolean;
+}
+export interface JudgeStats {
+    /** Candidates the narrowing pass selected (≤ the per-run cap). */
+    readonly candidates: number;
+    /** Judge-confirmed → became proposals. */
+    readonly confirmed: number;
+    /** Judge said no — dropped, no proposal. */
+    readonly rejected: number;
+    /** Judge call failed / unparseable — dropped quietly, no proposal. */
+    readonly failed: number;
+}
+export interface JudgedTidyResult extends TidyResult {
+    readonly judged: JudgeStats;
+}
+/**
+ * Run the Mode-2 tidy over one silo's files — the v1, zero-LLM path with heuristic destructive detection. Pure, with the clock injected.
+ * The schedule uses it only when no judge transport is registered.
+ *
+ * 🔴 THIS PATH NEVER PROPOSES A `supersede`, AND THAT IS THE FINDING, NOT A GAP (OPE-1995). A
+ * supersede deletes a line that no date orders and no key identifies, and the measurement on
+ * `DESTRUCTIVE_KINDS` in ops.ts shows the false-positive class scoring ABOVE the true class on this
+ * repo's own kernel. A zero-LLM path has only a score, so it would have to pick a bar that provably
+ * does not exist. `tidySiloJudged` is the only path that may raise the kind, because only a judge
+ * can tell the two classes apart.
+ */
+export declare function tidySilo(input: MemoryFiles, opts?: TidyOptions): TidyResult;
+/**
+ * The v2 tidy: the same safe layer, but destructive proposals come ONLY from the judge, and any failure on a candidate drops it quietly rather than proposing.
+ * `scope` is the silo name — it routes the judge's model and labels the audit trail.
+ */
+export declare function tidySiloJudged(input: MemoryFiles, scope: string, judge: DreamJudge, opts?: TidyOptions & CandidateOptions): Promise<JudgedTidyResult>;
+//# sourceMappingURL=tidy.d.ts.map

package/dist/agent/memory/dream/tidy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tidy.d.ts","sourceRoot":"","sources":["../../../../agent/memory/dream/tidy.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAQL,KAAK,QAAQ,EACd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAkB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAoB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IACpB,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAUD;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,GAAE,WAAgB,GAAG,UAAU,CAgB/E;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,EACjB,IAAI,GAAE,WAAW,GAAG,gBAAqB,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAqD3B"}

package/dist/agent/memory/dream/tidy.js

@@ -0,0 +1,96 @@
+// Mode 2 tidy over one silo's materialised markdown: the SAFE ops (dedup, link-repair, salience-reorder) are auto-applied, and destructive ops are only ever surfaced as PROPOSALS. Pure; the schedule does the I/O.
+// Both destructive paths skip the bullets of a file carrying the human-edit marker (memory/provenance.ts), so a person's direct edit is never proposed away as drift.
+import { buildGraph } from "../graph.js";
+import { dedupBullets, repairLinks, reorderBySalience, detectConsolidations, detectContradictions, detectStale, restatesDonor, } from "./ops.js";
+import { salienceScores } from "./salience.js";
+import { selectCandidates } from "./candidates.js";
+import { humanEditedFiles } from "../provenance.js";
+import { conserveProvenanceOnMerge } from "../provenance-mark.js";
+// The safe auto-applies both paths share — each one idempotent and non-lossy.
+function applySafeOps(input) {
+    const deduped = dedupBullets(input);
+    const repaired = repairLinks(deduped.files);
+    const reordered = reorderBySalience(repaired.files);
+    return { files: reordered.files, applied: [...deduped.ops, ...repaired.ops, ...reordered.ops] };
+}
+/**
+ * Run the Mode-2 tidy over one silo's files — the v1, zero-LLM path with heuristic destructive detection. Pure, with the clock injected.
+ * The schedule uses it only when no judge transport is registered.
+ *
+ * 🔴 THIS PATH NEVER PROPOSES A `supersede`, AND THAT IS THE FINDING, NOT A GAP (OPE-1995). A
+ * supersede deletes a line that no date orders and no key identifies, and the measurement on
+ * `DESTRUCTIVE_KINDS` in ops.ts shows the false-positive class scoring ABOVE the true class on this
+ * repo's own kernel. A zero-LLM path has only a score, so it would have to pick a bar that provably
+ * does not exist. `tidySiloJudged` is the only path that may raise the kind, because only a judge
+ * can tell the two classes apart.
+ */
+export function tidySilo(input, opts = {}) {
+    const { files, applied } = applySafeOps(input);
+    // The marker check reads `input`, the files as read: the marker is a comment line, so the safe layer leaves it untouched either way.
+    const humanEdited = humanEditedFiles(input);
+    const now = opts.now ?? new Date();
+    const proposals = [
+        ...detectConsolidations(files, opts.consolidateThreshold ?? 0.7, humanEdited),
+        ...detectContradictions(files, undefined, humanEdited),
+        ...detectStale(files, now, opts.staleDays ?? 180, humanEdited),
+    ];
+    const salience = salienceScores(buildGraph(files));
+    const changed = JSON.stringify(files) !== JSON.stringify(input);
+    return { files, applied, proposals, salience, changed };
+}
+/**
+ * The v2 tidy: the same safe layer, but destructive proposals come ONLY from the judge, and any failure on a candidate drops it quietly rather than proposing.
+ * `scope` is the silo name — it routes the judge's model and labels the audit trail.
+ */
+export async function tidySiloJudged(input, scope, judge, opts = {}) {
+    const { files, applied } = applySafeOps(input);
+    const humanEdited = humanEditedFiles(input);
+    const exclude = opts.exclude ? new Set([...opts.exclude, ...humanEdited]) : humanEdited;
+    const candidates = selectCandidates(files, { ...opts, exclude }); // bounded — the per-run inference budget
+    const proposals = [];
+    let rejected = 0;
+    let failed = 0;
+    for (const c of candidates) {
+        let verdict;
+        try {
+            verdict = await judge.judge(scope, c);
+        }
+        catch {
+            verdict = null; // a well-behaved judge never throws; belt-and-braces anyway
+        }
+        if (verdict === null) {
+            failed++;
+            continue;
+        }
+        if (!verdict.confirm) {
+            rejected++;
+            continue;
+        }
+        // A consolidation survivor always inherits the first disclosing source's provenance. A `stale`/`contradiction`/`supersede` survivor inherits it only when `restatesDonor` reads the kept text as a re-typing of the marked bullet (OPE-1444).
+        // `supersede` takes the guarded arm deliberately: its survivor is the NEWER of two statements, so it is normally a different fact from the marked donor, exactly as a `stale` survivor is — not a re-wording of it.
+        // `verdict.keep` is free model text, so without that test an unmarked re-typing would launder the disclosure away.
+        let after = verdict.keep;
+        if (after !== undefined &&
+            (c.kind === "consolidate" || restatesDonor(after, c.bullets, opts.restatementThreshold))) {
+            after = conserveProvenanceOnMerge(after, c.bullets);
+        }
+        proposals.push({
+            kind: c.kind,
+            file: c.file,
+            summary: `judge-confirmed ${c.kind} — ${verdict.note ?? c.reason}`,
+            before: c.bullets.join("\n"),
+            after,
+        });
+    }
+    const salience = salienceScores(buildGraph(files));
+    const changed = JSON.stringify(files) !== JSON.stringify(input);
+    return {
+        files,
+        applied,
+        proposals,
+        salience,
+        changed,
+        judged: { candidates: candidates.length, confirmed: proposals.length, rejected, failed },
+    };
+}
+//# sourceMappingURL=tidy.js.map

package/dist/agent/memory/dream/tidy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tidy.js","sourceRoot":"","sources":["../../../../agent/memory/dream/tidy.ts"],"names":[],"mappings":"AAAA,qNAAqN;AACrN,sKAAsK;AAEtK,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,YAAY,EACZ,WAAW,EACX,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,WAAW,EACX,aAAa,GAEd,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,cAAc,EAAqB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAyB,MAAM,iBAAiB,CAAC;AAE1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AA2ClE,8EAA8E;AAC9E,SAAS,YAAY,CAAC,KAAkB;IACtC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAClG,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAkB,EAAE,IAAI,GAAgB,EAAE;IACjE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAE/C,qIAAqI;IACrI,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAE5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG;QAChB,GAAG,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,oBAAoB,IAAI,GAAG,EAAE,WAAW,CAAC;QAC7E,GAAG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC;QACtD,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,WAAW,CAAC;KAC/D,CAAC;IAEF,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAkB,EAClB,KAAa,EACb,KAAiB,EACjB,IAAI,GAAmC,EAAE;IAEzC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAE/C,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACxF,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,yCAAyC;IAC3G,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,IAAI,CAAC,CAAC,4DAA4D;QAC9E,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,QAAQ,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,8OAA8O;QAC9O,oNAAoN;QACpN,mHAAmH;QACnH,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IACE,KAAK,KAAK,SAAS;YACnB,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,EACxF,CAAC;YACD,KAAK,GAAG,yBAAyB,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,mBAAmB,CAAC,CAAC,IAAI,MAAM,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE;YAClE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO;QACL,KAAK;QACL,OAAO;QACP,SAAS;QACT,QAAQ;QACR,OAAO;QACP,MAAM,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;KACzF,CAAC;AACJ,CAAC"}

package/dist/agent/memory/graph.d.ts

@@ -0,0 +1,46 @@
+import type { MemoryFiles } from "./store.js";
+export interface MemoryEdge {
+    /** Source node id — the markdown file that contains the link (relPath minus `.md`). */
+    readonly from: string;
+    /** Target node id — a resolved file/topic, or the cleaned raw link text when dangling. */
+    readonly to: string;
+    /** True when `to` matched a known file/topic; false marks a dangling link (kept: it's intent). */
+    readonly resolved: boolean;
+}
+export interface MemoryGraph {
+    readonly nodes: readonly string[];
+    /** Deduped edges (one per distinct from→to pair). */
+    readonly edges: readonly MemoryEdge[];
+}
+export interface BoostOptions {
+    /**
+     * Which edges connect a seed to a neighbour. Default `both` — recall benefits from a symmetric association.
+     * `in` matches resolved edges only, because only a resolved edge has a real node on its `to` side.
+     */
+    readonly direction?: "out" | "in" | "both";
+    /** Include dangling targets as neighbours. Default false — a dangling link points at no file, so there is nothing to resurface. */
+    readonly includeUnresolved?: boolean;
+}
+/** A neighbor surfaced by the boost, with its (edge-count) weight. */
+export interface NeighborBoost {
+    readonly node: string;
+    readonly weight: number;
+}
+/**
+ * The wikilink targets in document order, with a `|alias` and a `#anchor` stripped and empty links dropped.
+ * Duplicates are kept — the caller dedups at edge level.
+ */
+export declare function parseWikiLinks(content: string): string[];
+export declare function resolveNode(graph: MemoryGraph, ref: string): string | null;
+/**
+ * Only markdown files are nodes; each file's links become edges to the resolved target, or to the cleaned raw text when dangling (`resolved:false`).
+ * Self-links are kept, edges are deduped per from-to pair, and a dangling link never throws — an unresolved link is valid intent.
+ */
+export declare function buildGraph(files: MemoryFiles): MemoryGraph;
+/**
+ * 1-hop boost: the neighbours of the seed refs, weighted by how many edges tie them to the seed set.
+ * A seed that does not resolve to a node is ignored, and a neighbour that is itself a seed is dropped.
+ */
+export declare function adjacencyBoost(graph: MemoryGraph, seeds: readonly string[], opts?: BoostOptions): NeighborBoost[];
+export declare function graphToJSON(graph: MemoryGraph): string;
+//# sourceMappingURL=graph.d.ts.map

package/dist/agent/memory/graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../../agent/memory/graph.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,UAAU;IACzB,uFAAuF;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,kGAAkG;IAClG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,IAAI,GAAG,MAAM,CAAC;IAC3C,mIAAmI;IACnI,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAkCD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAOxD;AA8BD,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE1E;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,CAoB1D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,WAAW,EAClB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,IAAI,GAAE,YAAiB,GACtB,aAAa,EAAE,CA0BjB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAEtD"}