@rigour-labs/core 5.5.4 → 6.1.0-beta.1

package/dist/storage/db.js

@@ -45,7 +45,7 @@ function loadSqlite3() {
 const RIGOUR_DIR = path.join(os.homedir(), '.rigour');
 const DB_PATH = path.join(RIGOUR_DIR, 'rigour.db');
 /** Current schema version — bump when adding migrations. */
-const SCHEMA_VERSION = 4;
+const SCHEMA_VERSION = 7;
 const SCHEMA_SQL = `
 -- Schema version tracking
 CREATE TABLE IF NOT EXISTS meta (
@@ -177,6 +177,61 @@ CREATE TABLE IF NOT EXISTS checkpoint_metrics (
     created_at INTEGER NOT NULL
 );
 
+-- Evidence-gated learning produced during normal agent interaction.
+CREATE TABLE IF NOT EXISTS lessons (
+    id TEXT PRIMARY KEY,
+    repository_id TEXT NOT NULL,
+    actor_id TEXT,
+    team_id TEXT,
+    visibility TEXT NOT NULL DEFAULT 'personal',
+    state TEXT NOT NULL DEFAULT 'candidate',
+    kind TEXT NOT NULL,
+    subject TEXT NOT NULL,
+    evidence_json TEXT NOT NULL,
+    confidence REAL NOT NULL DEFAULT 0.3,
+    source TEXT NOT NULL,
+    supersedes_id TEXT,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS sync_outbox (
+    id TEXT PRIMARY KEY,
+    operation TEXT NOT NULL,
+    entity_type TEXT NOT NULL,
+    entity_id TEXT NOT NULL,
+    payload_json TEXT NOT NULL,
+    attempts INTEGER NOT NULL DEFAULT 0,
+    last_error TEXT,
+    created_at INTEGER NOT NULL,
+    synced_at INTEGER
+);
+
+-- Stable repository registry used by cross-project learning and graph views.
+CREATE TABLE IF NOT EXISTS repositories (
+    id TEXT PRIMARY KEY,
+    canonical_uri TEXT NOT NULL,
+    display_name TEXT NOT NULL,
+    last_seen INTEGER NOT NULL
+);
+
+-- Append-only observations from normal governed agent work. These are evidence,
+-- not reusable rules; lesson promotion remains a separate gated decision.
+CREATE TABLE IF NOT EXISTS interaction_events (
+    id TEXT PRIMARY KEY,
+    repository_id TEXT NOT NULL,
+    actor_id TEXT,
+    task_id TEXT,
+    session_id TEXT,
+    request_id TEXT NOT NULL,
+    tool_name TEXT NOT NULL,
+    phase TEXT NOT NULL,
+    outcome TEXT NOT NULL,
+    deterministic INTEGER NOT NULL DEFAULT 0,
+    evidence_json TEXT NOT NULL,
+    created_at INTEGER NOT NULL
+);
+
 -- Indexes for performance
 CREATE INDEX IF NOT EXISTS idx_scans_repo ON scans(repo);
 CREATE INDEX IF NOT EXISTS idx_scans_timestamp ON scans(timestamp);
@@ -192,6 +247,11 @@ CREATE INDEX IF NOT EXISTS idx_model_usage_task ON model_usage(task_id);
 CREATE INDEX IF NOT EXISTS idx_model_usage_created ON model_usage(created_at);
 CREATE INDEX IF NOT EXISTS idx_context_cache_type ON context_cache(cache_type);
 CREATE INDEX IF NOT EXISTS idx_checkpoint_metrics_task ON checkpoint_metrics(task_id);
+CREATE INDEX IF NOT EXISTS idx_lessons_lookup ON lessons(repository_id, actor_id, team_id, state);
+CREATE INDEX IF NOT EXISTS idx_sync_outbox_pending ON sync_outbox(synced_at, created_at);
+CREATE INDEX IF NOT EXISTS idx_repositories_last_seen ON repositories(last_seen);
+CREATE INDEX IF NOT EXISTS idx_interaction_events_repo_created ON interaction_events(repository_id, created_at);
+CREATE INDEX IF NOT EXISTS idx_interaction_events_request ON interaction_events(request_id);
 `;
 function wrapDatabase(raw) {
     const db = {
@@ -369,6 +429,75 @@ async function runMigrations(db) {
         `);
         await db.run("INSERT OR REPLACE INTO meta (key, value) VALUES ('schema_version', '4')");
     }
+    if (current < 5) {
+        await db.exec(`
+            CREATE TABLE IF NOT EXISTS lessons (
+                id TEXT PRIMARY KEY,
+                repository_id TEXT NOT NULL,
+                actor_id TEXT,
+                team_id TEXT,
+                visibility TEXT NOT NULL DEFAULT 'personal',
+                state TEXT NOT NULL DEFAULT 'candidate',
+                kind TEXT NOT NULL,
+                subject TEXT NOT NULL,
+                evidence_json TEXT NOT NULL,
+                confidence REAL NOT NULL DEFAULT 0.3,
+                source TEXT NOT NULL,
+                supersedes_id TEXT,
+                created_at INTEGER NOT NULL,
+                updated_at INTEGER NOT NULL
+            );
+            CREATE TABLE IF NOT EXISTS sync_outbox (
+                id TEXT PRIMARY KEY,
+                operation TEXT NOT NULL,
+                entity_type TEXT NOT NULL,
+                entity_id TEXT NOT NULL,
+                payload_json TEXT NOT NULL,
+                attempts INTEGER NOT NULL DEFAULT 0,
+                last_error TEXT,
+                created_at INTEGER NOT NULL,
+                synced_at INTEGER
+            );
+            CREATE INDEX IF NOT EXISTS idx_lessons_lookup ON lessons(repository_id, actor_id, team_id, state);
+            CREATE INDEX IF NOT EXISTS idx_sync_outbox_pending ON sync_outbox(synced_at, created_at);
+        `);
+        await db.run("INSERT OR REPLACE INTO meta (key, value) VALUES ('schema_version', '5')");
+    }
+    if (current < 6) {
+        await db.exec(`
+            CREATE TABLE IF NOT EXISTS repositories (
+                id TEXT PRIMARY KEY,
+                canonical_uri TEXT NOT NULL,
+                display_name TEXT NOT NULL,
+                last_seen INTEGER NOT NULL
+            );
+            CREATE INDEX IF NOT EXISTS idx_repositories_last_seen ON repositories(last_seen);
+        `);
+        await db.run("INSERT OR REPLACE INTO meta (key, value) VALUES ('schema_version', '6')");
+    }
+    if (current < 7) {
+        await db.exec(`
+            CREATE TABLE IF NOT EXISTS interaction_events (
+                id TEXT PRIMARY KEY,
+                repository_id TEXT NOT NULL,
+                actor_id TEXT,
+                task_id TEXT,
+                session_id TEXT,
+                request_id TEXT NOT NULL,
+                tool_name TEXT NOT NULL,
+                phase TEXT NOT NULL,
+                outcome TEXT NOT NULL,
+                deterministic INTEGER NOT NULL DEFAULT 0,
+                evidence_json TEXT NOT NULL,
+                created_at INTEGER NOT NULL
+            );
+            CREATE INDEX IF NOT EXISTS idx_interaction_events_repo_created
+                ON interaction_events(repository_id, created_at);
+            CREATE INDEX IF NOT EXISTS idx_interaction_events_request
+                ON interaction_events(request_id);
+        `);
+        await db.run("INSERT OR REPLACE INTO meta (key, value) VALUES ('schema_version', '7')");
+    }
 }
 /**
  * Compact the database — prune old data, reclaim disk space.

package/dist/storage/index.d.ts

@@ -11,3 +11,7 @@ export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './loca
 export type { ProjectStats } from './local-memory.js';
 export { recordContextEvent, recordModelUsage, setContextCacheRecord, getContextCacheRecord, listContextCacheRecords, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics } from './context-telemetry.js';
 export type { ContextEvent, ModelUsage, ContextCacheRecord, CheckpointMetric } from './context-telemetry.js';
+export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId } from './lessons.js';
+export type { ApplicableLessons, InteractionEvidence, LessonRecord, LessonState, LessonVisibility } from './lessons.js';
+export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, } from './team-store.js';
+export type { TeamConfiguration, TeamSemanticConfiguration, TeamModeStatus, TeamDoctorResult, SemanticKnowledgeCandidate, SemanticKnowledgeResult, } from './team-store.js';

package/dist/storage/index.js

@@ -8,3 +8,5 @@ export { insertFindings, getFindingsForScan, getDeepFindings } from './findings.
 export { reinforcePattern, decayPatterns, getStrongPatterns, getPatterns, getHardRules } from './patterns.js';
 export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './local-memory.js';
 export { recordContextEvent, recordModelUsage, setContextCacheRecord, getContextCacheRecord, listContextCacheRecords, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics } from './context-telemetry.js';
+export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId } from './lessons.js';
+export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, } from './team-store.js';

package/dist/storage/lessons.d.ts

@@ -0,0 +1,60 @@
+export type LessonState = 'candidate' | 'validated' | 'promoted' | 'rejected' | 'superseded';
+export type LessonVisibility = 'personal' | 'team';
+export interface LessonRecord {
+    id: string;
+    repositoryId: string;
+    actorId?: string;
+    teamId?: string;
+    visibility: LessonVisibility;
+    state: LessonState;
+    kind: string;
+    subject: string;
+    evidence: Record<string, unknown>;
+    confidence: number;
+    source: string;
+    supersedesId?: string;
+    createdAt: number;
+    updatedAt: number;
+    repositoryName?: string;
+}
+export interface InteractionEvidence {
+    tool: string;
+    outcome: 'success' | 'error' | 'rejected';
+    requestId: string;
+    taskId?: string;
+    agentId?: string;
+    deterministic?: boolean;
+    verifiedOutcome?: boolean;
+    phase?: 'request' | 'response';
+    sessionId?: string;
+    files?: string[];
+    summary?: string;
+    /** A concise, evidence-backed proposition that could be reused beyond this call. */
+    reusableClaim?: string;
+}
+export declare function shouldValidateInteractionLesson(evidence: InteractionEvidence, verifiedSuccessfulOutcomes?: number): boolean;
+export declare function recordInteractionEvidence(cwd: string, evidence: InteractionEvidence): Promise<string | null>;
+export declare function countInteractionEvidence(cwd: string): Promise<number>;
+export declare function getRepositoryId(cwd: string): Promise<string>;
+export declare function recordInteractionLesson(cwd: string, evidence: InteractionEvidence): Promise<string | null>;
+export declare function listLessons(cwd: string, limit?: number): Promise<LessonRecord[]>;
+/**
+ * Returns the evidence visible to the current workspace for exploration. Cross-repository
+ * records are candidates only; getApplicableLessons remains the enforcement boundary.
+ */
+export declare function listKnowledgeLessons(cwd: string, limit?: number): Promise<LessonRecord[]>;
+export interface ApplicableLessons {
+    lessons: Array<LessonRecord & {
+        priority: number;
+        provenance: string;
+    }>;
+    conflicts: Array<{
+        subject: string;
+        lessonIds: string[];
+    }>;
+}
+export declare function getApplicableLessons(cwd: string, actorId?: string, teamId?: string): Promise<ApplicableLessons>;
+export declare function transitionLesson(id: string, state: LessonState, options?: {
+    visibility?: LessonVisibility;
+    queueSync?: boolean;
+}): Promise<boolean>;

package/dist/storage/lessons.js

@@ -0,0 +1,322 @@
+import { createHash, randomUUID } from 'crypto';
+import fs from 'fs-extra';
+import path from 'path';
+import { openDatabase } from './db.js';
+import { decryptLocalPayload, encryptLocalPayload } from './local-encryption.js';
+import { loadTeamConfiguration } from './team-store.js';
+export function shouldValidateInteractionLesson(evidence, verifiedSuccessfulOutcomes = 0) {
+    return evidence.outcome === 'success'
+        && Boolean(evidence.reusableClaim?.trim())
+        && (evidence.deterministic === true || verifiedSuccessfulOutcomes >= 3);
+}
+export async function recordInteractionEvidence(cwd, evidence) {
+    const db = await openDatabase();
+    if (!db)
+        return null;
+    try {
+        const repositoryId = await getRepositoryId(cwd);
+        await registerRepository(db, cwd, repositoryId);
+        const config = await loadTeamConfiguration();
+        const id = `observation-${randomUUID()}`;
+        await db.run(`INSERT INTO interaction_events (
+                id, repository_id, actor_id, task_id, session_id, request_id,
+                tool_name, phase, outcome, deterministic, evidence_json, created_at
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, id, repositoryId, config?.actorId || process.env.RIGOUR_ACTOR_ID || null, evidence.taskId || null, evidence.sessionId || null, evidence.requestId, evidence.tool, evidence.phase || 'response', evidence.outcome, evidence.deterministic ? 1 : 0, await encryptLocalPayload({ files: evidence.files || [], summary: evidence.summary }), Date.now());
+        return id;
+    }
+    finally {
+        await db.close();
+    }
+}
+export async function countInteractionEvidence(cwd) {
+    const db = await openDatabase();
+    if (!db)
+        return 0;
+    try {
+        const repositoryId = await getRepositoryId(cwd);
+        const row = await db.get('SELECT COUNT(*) AS count FROM interaction_events WHERE repository_id = ?', repositoryId);
+        return Number(row?.count || 0);
+    }
+    finally {
+        await db.close();
+    }
+}
+function normalizeRemote(remote) {
+    return remote.trim().replace(/^git@([^:]+):/, 'https://$1/').replace(/\.git$/, '').toLowerCase();
+}
+async function readGitConfig(cwd) {
+    const dotGit = path.join(cwd, '.git');
+    const stat = await fs.stat(dotGit);
+    if (stat.isDirectory())
+        return fs.readFile(path.join(dotGit, 'config'), 'utf8');
+    const pointer = await fs.readFile(dotGit, 'utf8');
+    const match = pointer.match(/^gitdir:\s*(.+)$/m);
+    if (!match)
+        throw new Error('Invalid Git directory pointer.');
+    const gitDir = path.resolve(cwd, match[1].trim());
+    try {
+        return await fs.readFile(path.join(gitDir, 'config'), 'utf8');
+    }
+    catch {
+        // Linked worktrees usually keep the shared remote configuration here.
+        const commonDir = (await fs.readFile(path.join(gitDir, 'commondir'), 'utf8')).trim();
+        return fs.readFile(path.resolve(gitDir, commonDir, 'config'), 'utf8');
+    }
+}
+export async function getRepositoryId(cwd) {
+    let identity = path.resolve(cwd);
+    try {
+        const config = await readGitConfig(cwd);
+        const remote = config.match(/\[remote\s+"origin"\][\s\S]*?url\s*=\s*([^\n]+)/)?.[1];
+        if (remote)
+            identity = normalizeRemote(remote);
+    }
+    catch {
+        // Non-git workspaces retain a stable path-derived local identity.
+    }
+    return createHash('sha256').update(identity).digest('hex');
+}
+async function registerRepository(db, cwd, repositoryId) {
+    let canonicalUri = path.resolve(cwd);
+    try {
+        const config = await readGitConfig(cwd);
+        const remote = config.match(/\[remote\s+"origin"\][\s\S]*?url\s*=\s*([^\n]+)/)?.[1];
+        if (remote)
+            canonicalUri = normalizeRemote(remote);
+    }
+    catch {
+        // Non-git workspaces use their resolved path as the canonical local identity.
+    }
+    const remoteName = canonicalUri.split('/').filter(Boolean).at(-1);
+    await db.run(`INSERT INTO repositories (id, canonical_uri, display_name, last_seen) VALUES (?, ?, ?, ?)
+         ON CONFLICT(id) DO UPDATE SET canonical_uri=excluded.canonical_uri,
+             display_name=excluded.display_name, last_seen=excluded.last_seen`, repositoryId, canonicalUri, remoteName || path.basename(cwd), Date.now());
+}
+async function rowToLesson(row) {
+    return {
+        id: String(row.id),
+        repositoryId: String(row.repository_id),
+        actorId: row.actor_id ? String(row.actor_id) : undefined,
+        teamId: row.team_id ? String(row.team_id) : undefined,
+        visibility: row.visibility,
+        state: row.state,
+        kind: String(row.kind),
+        subject: String(row.subject),
+        evidence: await decryptLocalPayload(String(row.evidence_json)),
+        confidence: Number(row.confidence),
+        source: String(row.source),
+        supersedesId: row.supersedes_id ? String(row.supersedes_id) : undefined,
+        createdAt: Number(row.created_at),
+        updatedAt: Number(row.updated_at),
+        repositoryName: row.repository_name ? String(row.repository_name) : undefined,
+    };
+}
+export async function recordInteractionLesson(cwd, evidence) {
+    const db = await openDatabase();
+    if (!db)
+        return null;
+    try {
+        const repositoryId = await getRepositoryId(cwd);
+        await registerRepository(db, cwd, repositoryId);
+        const id = `lesson-${randomUUID()}`;
+        const now = Date.now();
+        const verifiedSuccess = shouldValidateInteractionLesson(evidence, evidence.verifiedOutcome ? 3 : 0);
+        const confidence = verifiedSuccess ? 0.8 : 0.3;
+        const state = confidence >= 0.8 ? 'validated' : 'candidate';
+        const config = await loadTeamConfiguration();
+        const actorId = config?.actorId || process.env.RIGOUR_ACTOR_ID || null;
+        const priorRow = await db.get(`SELECT * FROM lessons
+             WHERE repository_id = ? AND actor_id IS ? AND visibility = 'personal'
+               AND state = 'candidate' AND kind = 'interaction' AND subject = ?
+             ORDER BY updated_at DESC LIMIT 1`, repositoryId, actorId, evidence.reusableClaim?.trim() || `interaction:${evidence.tool}`);
+        if (priorRow) {
+            const prior = await rowToLesson(priorRow);
+            const previousSuccesses = Number(prior.evidence.successfulOutcomes ?? 0);
+            const successfulOutcomes = previousSuccesses + (evidence.outcome === 'success' ? 1 : 0);
+            const previousVerified = Number(prior.evidence.verifiedSuccessfulOutcomes ?? 0);
+            const verifiedSuccessfulOutcomes = previousVerified + (evidence.verifiedOutcome && evidence.outcome === 'success' ? 1 : 0);
+            const repeatedValidation = shouldValidateInteractionLesson(evidence, verifiedSuccessfulOutcomes);
+            const mergedEvidence = {
+                ...evidence,
+                observationCount: Number(prior.evidence.observationCount ?? 1) + 1,
+                successfulOutcomes,
+                verifiedSuccessfulOutcomes,
+                previousRequestId: prior.evidence.requestId,
+            };
+            const updated = {
+                ...prior,
+                state: repeatedValidation ? 'validated' : 'candidate',
+                evidence: mergedEvidence,
+                confidence: repeatedValidation ? 0.8 : Math.min(0.7, prior.confidence + 0.15),
+                updatedAt: now,
+            };
+            await db.run('UPDATE lessons SET state = ?, evidence_json = ?, confidence = ?, updated_at = ? WHERE id = ?', updated.state, await encryptLocalPayload(updated.evidence), updated.confidence, updated.updatedAt, updated.id);
+            if (config)
+                await queueLessonSync(db, updated, now);
+            return prior.id;
+        }
+        const storedEvidence = {
+            ...evidence,
+            observationCount: 1,
+            successfulOutcomes: evidence.outcome === 'success' ? 1 : 0,
+            verifiedSuccessfulOutcomes: evidence.verifiedOutcome && evidence.outcome === 'success' ? 1 : 0,
+        };
+        const encryptedEvidence = await encryptLocalPayload(storedEvidence);
+        await db.run(`INSERT INTO lessons (
+                id, repository_id, actor_id, team_id, visibility, state, kind, subject,
+                evidence_json, confidence, source, created_at, updated_at
+            ) VALUES (?, ?, ?, ?, 'personal', ?, 'interaction', ?, ?, ?, 'mcp', ?, ?)`, id, repositoryId, actorId, config?.teamId || process.env.RIGOUR_TEAM_ID || null, state, evidence.reusableClaim?.trim() || `interaction:${evidence.tool}`, encryptedEvidence, confidence, now, now);
+        if (config) {
+            const personal = await txSafeLesson(db, id);
+            if (personal)
+                await queueLessonSync(db, personal, now);
+        }
+        return id;
+    }
+    finally {
+        await db.close();
+    }
+}
+async function queueLessonSync(db, lesson, now) {
+    await db.run(`INSERT INTO sync_outbox (id, operation, entity_type, entity_id, payload_json, created_at)
+         VALUES (?, 'upsert', 'lesson', ?, ?, ?)`, `outbox-${randomUUID()}`, lesson.id, await encryptLocalPayload(lesson), now);
+}
+export async function listLessons(cwd, limit = 100) {
+    let db;
+    try {
+        db = await openDatabase();
+    }
+    catch {
+        return [];
+    }
+    if (!db)
+        return [];
+    try {
+        const repositoryId = await getRepositoryId(cwd);
+        await registerRepository(db, cwd, repositoryId);
+        const rows = await db.all(`SELECT lessons.*, repositories.display_name AS repository_name
+             FROM lessons LEFT JOIN repositories ON repositories.id = lessons.repository_id
+             WHERE repository_id = ?
+             ORDER BY updated_at DESC LIMIT ?`, repositoryId, limit);
+        return await Promise.all(rows.map(rowToLesson));
+    }
+    finally {
+        await db.close();
+    }
+}
+/**
+ * Returns the evidence visible to the current workspace for exploration. Cross-repository
+ * records are candidates only; getApplicableLessons remains the enforcement boundary.
+ */
+export async function listKnowledgeLessons(cwd, limit = 500) {
+    let db;
+    try {
+        db = await openDatabase();
+    }
+    catch {
+        return [];
+    }
+    if (!db)
+        return [];
+    try {
+        const repositoryId = await getRepositoryId(cwd);
+        await registerRepository(db, cwd, repositoryId);
+        const config = await loadTeamConfiguration();
+        const rows = config
+            ? await db.all(`SELECT lessons.*, repositories.display_name AS repository_name
+                 FROM lessons LEFT JOIN repositories ON repositories.id = lessons.repository_id
+                 WHERE lessons.repository_id = ?
+                    OR (lessons.visibility = 'personal' AND lessons.actor_id = ?)
+                    OR (lessons.visibility = 'team' AND lessons.team_id = ? AND lessons.state = 'promoted')
+                 ORDER BY lessons.updated_at DESC LIMIT ?`, repositoryId, config.actorId, config.teamId, limit)
+            : await db.all(`SELECT lessons.*, repositories.display_name AS repository_name
+                 FROM lessons LEFT JOIN repositories ON repositories.id = lessons.repository_id
+                 WHERE lessons.repository_id = ?
+                    OR (lessons.visibility = 'personal' AND lessons.actor_id IS NULL)
+                 ORDER BY lessons.updated_at DESC LIMIT ?`, repositoryId, limit);
+        return await Promise.all(rows.map(rowToLesson));
+    }
+    finally {
+        await db.close();
+    }
+}
+export async function getApplicableLessons(cwd, actorId, teamId) {
+    const repositoryId = await getRepositoryId(cwd);
+    const all = await listKnowledgeLessons(cwd, 500);
+    const applicable = all
+        .filter(lesson => lesson.state === 'validated' || lesson.state === 'promoted')
+        .filter(lesson => lesson.visibility === 'team' || !actorId || !lesson.actorId || lesson.actorId === actorId)
+        .filter(lesson => !teamId || !lesson.teamId || lesson.teamId === teamId)
+        .map(lesson => {
+        const priority = lesson.repositoryId === repositoryId ? 1 : lesson.visibility === 'personal' ? 2 : 3;
+        return { ...lesson, priority, provenance: `${lesson.visibility}:${lesson.source}:${lesson.id}` };
+    })
+        .sort((a, b) => a.priority - b.priority || b.confidence - a.confidence);
+    const bySubject = new Map();
+    for (const lesson of applicable)
+        bySubject.set(lesson.subject, [...(bySubject.get(lesson.subject) ?? []), lesson]);
+    const conflicts = [...bySubject.entries()]
+        .filter(([, lessons]) => new Set(lessons.map(lesson => JSON.stringify(lesson.evidence))).size > 1)
+        .map(([subject, lessons]) => ({ subject, lessonIds: lessons.map(lesson => lesson.id) }));
+    return { lessons: applicable, conflicts };
+}
+export async function transitionLesson(id, state, options = {}) {
+    const db = await openDatabase();
+    if (!db)
+        return false;
+    const now = Date.now();
+    try {
+        return await db.transaction(async (tx) => {
+            const existing = await tx.get('SELECT * FROM lessons WHERE id = ?', id);
+            if (!existing)
+                return false;
+            const visibility = options.visibility ?? existing.visibility;
+            if (state === 'promoted' && visibility === 'team') {
+                const teamConfig = await loadTeamConfiguration();
+                if (!teamConfig) {
+                    throw new Error('Configure PostgreSQL team mode before publishing a team lesson.');
+                }
+                const source = await rowToLesson(existing);
+                const publishedId = `lesson-${randomUUID()}`;
+                const published = {
+                    ...source,
+                    id: publishedId,
+                    actorId: source.actorId || teamConfig.actorId,
+                    teamId: teamConfig.teamId,
+                    visibility: 'team',
+                    state: 'promoted',
+                    source: `published:${source.id}`,
+                    createdAt: now,
+                    updatedAt: now,
+                };
+                await tx.run(`INSERT INTO lessons (
+                        id, repository_id, actor_id, team_id, visibility, state, kind, subject,
+                        evidence_json, confidence, source, supersedes_id, created_at, updated_at
+                    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, published.id, published.repositoryId, published.actorId || null, published.teamId || null, published.visibility, published.state, published.kind, published.subject, await encryptLocalPayload(published.evidence), published.confidence, published.source, published.supersedesId || null, published.createdAt, published.updatedAt);
+                if (options.queueSync) {
+                    await tx.run(`INSERT INTO sync_outbox (id, operation, entity_type, entity_id, payload_json, created_at)
+                         VALUES (?, 'upsert', 'lesson', ?, ?, ?)`, `outbox-${randomUUID()}`, published.id, await encryptLocalPayload(published), now);
+                }
+                await tx.run("DELETE FROM context_cache WHERE cache_type = 'semantic'");
+                return true;
+            }
+            const result = await tx.run('UPDATE lessons SET state = ?, visibility = ?, updated_at = ? WHERE id = ?', state, visibility, now, id);
+            if (result.changes > 0)
+                await tx.run("DELETE FROM context_cache WHERE cache_type = 'semantic'");
+            if (result.changes > 0 && options.queueSync && visibility === 'team') {
+                const payload = { ...await rowToLesson(existing), state, visibility, updatedAt: now };
+                await tx.run(`INSERT INTO sync_outbox (
+                        id, operation, entity_type, entity_id, payload_json, created_at
+                    ) VALUES (?, 'upsert', 'lesson', ?, ?, ?)`, `outbox-${randomUUID()}`, id, await encryptLocalPayload(payload), now);
+            }
+            return result.changes > 0;
+        });
+    }
+    finally {
+        await db.close();
+    }
+}
+async function txSafeLesson(db, id) {
+    const row = await db.get('SELECT * FROM lessons WHERE id = ?', id);
+    return row ? rowToLesson(row) : null;
+}

package/dist/storage/lessons.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/storage/lessons.test.js

@@ -0,0 +1,50 @@
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { getRepositoryId, shouldValidateInteractionLesson } from './lessons.js';
+const roots = [];
+afterEach(async () => { await Promise.all(roots.splice(0).map((root) => fs.remove(root))); });
+describe('getRepositoryId', () => {
+    it('uses normalized origin identity instead of a basename', async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-repo-id-'));
+        roots.push(root);
+        await fs.ensureDir(path.join(root, '.git'));
+        await fs.writeFile(path.join(root, '.git', 'config'), '[remote "origin"]\nurl = git@github.com:Rigour-Labs/Rigour.git\n');
+        const first = await getRepositoryId(root);
+        const second = await getRepositoryId(path.join(root, '..', path.basename(root)));
+        expect(first).toBe(second);
+        expect(first).toHaveLength(64);
+    });
+    it('uses the shared origin identity from a linked worktree', async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-worktree-id-'));
+        roots.push(root);
+        const common = path.join(root, 'common');
+        const linkedGit = path.join(common, 'worktrees', 'feature');
+        const worktree = path.join(root, 'checkout');
+        await fs.ensureDir(linkedGit);
+        await fs.ensureDir(worktree);
+        await fs.writeFile(path.join(worktree, '.git'), `gitdir: ${linkedGit}\n`);
+        await fs.writeFile(path.join(linkedGit, 'commondir'), '../..\n');
+        await fs.writeFile(path.join(common, 'config'), '[remote "origin"]\nurl = https://github.com/rigour-labs/rigour.git\n');
+        const regular = path.join(root, 'regular');
+        await fs.ensureDir(path.join(regular, '.git'));
+        await fs.writeFile(path.join(regular, '.git', 'config'), '[remote "origin"]\nurl = git@github.com:Rigour-Labs/Rigour.git\n');
+        expect(await getRepositoryId(worktree)).toBe(await getRepositoryId(regular));
+        expect(await getRepositoryId(worktree)).toHaveLength(64);
+    });
+});
+describe('interaction lesson validation', () => {
+    const evidence = { tool: 'rigour_context_scope', outcome: 'success', requestId: 'req-1' };
+    it('keeps repeated unverified interaction as evidence only', () => {
+        expect(shouldValidateInteractionLesson(evidence, 0)).toBe(false);
+        expect(shouldValidateInteractionLesson(evidence, 2)).toBe(false);
+    });
+    it('validates deterministic or repeatedly verified outcomes', () => {
+        expect(shouldValidateInteractionLesson({ ...evidence, deterministic: true, reusableClaim: 'Use scoped retrieval before edits.' }, 0)).toBe(true);
+        expect(shouldValidateInteractionLesson({ ...evidence, verifiedOutcome: true, reusableClaim: 'Run the focused test suite.' }, 3)).toBe(true);
+    });
+    it('does not turn a successful tool call into reusable knowledge', () => {
+        expect(shouldValidateInteractionLesson({ ...evidence, deterministic: true }, 3)).toBe(false);
+    });
+});

package/dist/storage/local-encryption.d.ts

@@ -0,0 +1,2 @@
+export declare function encryptLocalPayload(value: unknown): Promise<string>;
+export declare function decryptLocalPayload<T>(value: string): Promise<T>;

package/dist/storage/local-encryption.js

@@ -0,0 +1,41 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+const KEY_PATH = path.join(os.homedir(), '.rigour', 'team-cache.key');
+async function getKey() {
+    const configured = process.env.RIGOUR_LOCAL_CACHE_KEY;
+    if (configured) {
+        const key = Buffer.from(configured, 'base64');
+        if (key.length !== 32)
+            throw new Error('RIGOUR_LOCAL_CACHE_KEY must be a base64-encoded 32-byte key.');
+        return key;
+    }
+    try {
+        const key = Buffer.from((await fs.readFile(KEY_PATH, 'utf8')).trim(), 'base64');
+        if (key.length === 32)
+            return key;
+    }
+    catch { /* create below */ }
+    const key = randomBytes(32);
+    await fs.ensureDir(path.dirname(KEY_PATH));
+    await fs.writeFile(KEY_PATH, key.toString('base64'), { mode: 0o600 });
+    await fs.chmod(KEY_PATH, 0o600);
+    return key;
+}
+export async function encryptLocalPayload(value) {
+    const key = await getKey();
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
+    return `enc:v1:${iv.toString('base64')}:${cipher.getAuthTag().toString('base64')}:${ciphertext.toString('base64')}`;
+}
+export async function decryptLocalPayload(value) {
+    if (!value.startsWith('enc:v1:'))
+        return JSON.parse(value);
+    const [, , ivValue, tagValue, ciphertextValue] = value.split(':');
+    const decipher = createDecipheriv('aes-256-gcm', await getKey(), Buffer.from(ivValue, 'base64'));
+    decipher.setAuthTag(Buffer.from(tagValue, 'base64'));
+    const plaintext = Buffer.concat([decipher.update(Buffer.from(ciphertextValue, 'base64')), decipher.final()]);
+    return JSON.parse(plaintext.toString('utf8'));
+}