@rigour-labs/core 6.2.0 → 6.2.2

package/dist/firewall/trusted-control.d.ts

@@ -29,6 +29,7 @@ interface GrantInput {
     parentCapabilityId?: string;
 }
 export declare function loadTrustedGrant(cwd: string, id: string, controlRoot?: string): Promise<CapabilityGrant | null>;
+export declare function listTrustedGrants(cwd: string, limit?: number, controlRoot?: string): Promise<CapabilityGrant[]>;
 export declare function issueTrustedGrant(cwd: string, input: GrantInput, controlRoot?: string): Promise<CapabilityGrant>;
 export declare function consumeTrustedGrant(cwd: string, input: {
     id: string;

package/dist/firewall/trusted-control.js

@@ -117,6 +117,25 @@ export async function loadTrustedGrant(cwd, id, controlRoot) {
         return null;
     return fs.readJson(source);
 }
+export async function listTrustedGrants(cwd, limit = 100, controlRoot) {
+    const grantsDir = path.join(getTrustedControlDir(cwd, controlRoot), 'capabilities');
+    if (!await fs.pathExists(grantsDir))
+        return [];
+    const files = (await fs.readdir(grantsDir))
+        .filter((file) => /^[0-9a-f-]{36}\.json$/i.test(file));
+    const grants = await Promise.all(files.map(async (file) => {
+        try {
+            return await fs.readJson(path.join(grantsDir, file));
+        }
+        catch {
+            return null;
+        }
+    }));
+    const requested = Number.isFinite(limit) ? Math.max(1, Math.floor(limit)) : 100;
+    return grants.filter((grant) => grant !== null)
+        .sort((a, b) => b.expiresAt - a.expiresAt)
+        .slice(0, requested);
+}
 function assertDelegationSubset(parent, input) {
     if (parent.used)
         throw new Error('Parent capability is already consumed');

package/dist/firewall/trusted-control.test.js

@@ -2,7 +2,7 @@ import { afterEach, describe, expect, it } from 'vitest';
 import fs from 'fs-extra';
 import os from 'os';
 import path from 'path';
-import { appendExecutionReceipt, consumeTrustedGrant, getTrustedControlDir, issueTrustedGrant, normalizeMcpAction, saveGatewayConfig, verifyExecutionReceiptChain, } from './index.js';
+import { appendExecutionReceipt, consumeTrustedGrant, getTrustedControlDir, issueTrustedGrant, listTrustedGrants, normalizeMcpAction, saveGatewayConfig, verifyExecutionReceiptChain, } from './index.js';
 const repositories = [];
 const controlRoots = [];
 async function repository() {
@@ -37,6 +37,19 @@ describe('trusted gateway control', () => {
         expect(location.startsWith(cwd)).toBe(false);
         expect(await fs.pathExists(location)).toBe(true);
     });
+    it('lists valid grants without failing on malformed control files', async () => {
+        const cwd = await repository();
+        const root = await controlRoot();
+        const grant = await issueTrustedGrant(cwd, {
+            issuerId: 'owner', subjectId: 'agent-1', taskId: 'task-1',
+            action: 'mcp.call', resource: 'mcp://files/read', ttlMs: 60_000,
+        }, root);
+        const grantsDir = path.join(getTrustedControlDir(cwd, root), 'capabilities');
+        await fs.writeFile(path.join(grantsDir, 'not-a-grant.json'), '{broken');
+        await expect(listTrustedGrants(cwd, 10, root)).resolves.toEqual([
+            expect.objectContaining({ id: grant.id, resource: 'mcp://files/read' }),
+        ]);
+    });
     it('consumes a capability exactly once', async () => {
         const cwd = await repository();
         const root = await controlRoot();

package/dist/index.d.ts

@@ -24,8 +24,8 @@ export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, rese
 export type { RigourDB, CompactResult } from './storage/index.js';
 export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './storage/index.js';
 export type { ProjectStats } from './storage/index.js';
-export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId } from './storage/index.js';
-export type { ApplicableLessons, InteractionEvidence, LessonRecord, LessonState, LessonVisibility } from './storage/index.js';
+export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId, queueLocalLessonsForTeam } from './storage/index.js';
+export type { ApplicableLessons, InteractionEvidence, LessonRecord, LessonState, LessonVisibility, LocalLessonImportOptions, LocalLessonImportResult } from './storage/index.js';
 export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, } from './storage/index.js';
 export type { TeamConfiguration, TeamSemanticConfiguration, TeamModeStatus, TeamDoctorResult, SemanticKnowledgeCandidate, SemanticKnowledgeResult, } from './storage/index.js';
 export { generateTemporalDriftReport, formatDriftSummary } from './services/temporal-drift.js';

package/dist/index.js

@@ -24,7 +24,7 @@ export { extractFacts, factsToPromptString } from './deep/fact-extractor.js';
 export { openDatabase, isSQLiteAvailable, compactDatabase, getDatabaseSize, resetDatabase, insertScan, insertFindings, getRecentScans, getScoreTrendFromDB, getTopIssues, reinforcePattern, getStrongPatterns } from './storage/index.js';
 // Local Project Memory (hybrid intelligence — SQLite-backed per-project learning)
 export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './storage/index.js';
-export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId } from './storage/index.js';
+export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId, queueLocalLessonsForTeam } from './storage/index.js';
 export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, } from './storage/index.js';
 // Temporal Drift Engine (v5 — cross-session trend analysis + per-provenance EWMA)
 export { generateTemporalDriftReport, formatDriftSummary } from './services/temporal-drift.js';

package/dist/services/engineering-knowledge-graph.d.ts

@@ -1,7 +1,8 @@
 import type { DependencyGraph } from '../context/dependency-graph.js';
+import type { CapabilityGrant, ExecutionReceipt } from '../firewall/types.js';
 import type { LessonRecord } from '../storage/lessons.js';
 import type { AgentHistoryEvent, AgentRun } from './agent-history.js';
-export type KnowledgeNodeType = 'repository' | 'file' | 'agent' | 'task' | 'run' | 'advice' | 'pattern' | 'memory' | 'lesson' | 'policy' | 'outcome';
+export type KnowledgeNodeType = 'repository' | 'file' | 'agent' | 'task' | 'run' | 'gateway' | 'action' | 'capability' | 'advice' | 'pattern' | 'memory' | 'lesson' | 'policy' | 'outcome';
 export interface KnowledgeNode {
     id: string;
     type: KnowledgeNodeType;
@@ -16,7 +17,7 @@ export interface KnowledgeEdge {
     id: string;
     from: string;
     to: string;
-    type: 'contains' | 'imports' | 'performed' | 'belongs_to' | 'touched' | 'produced' | 'resulted_in' | 'defined_in' | 'protects' | 'remembered' | 'guided' | 'informed';
+    type: 'contains' | 'imports' | 'performed' | 'belongs_to' | 'touched' | 'produced' | 'resulted_in' | 'defined_in' | 'protects' | 'remembered' | 'guided' | 'informed' | 'routes_through' | 'governed_by' | 'authorized_by' | 'delegated_from';
 }
 export interface EngineeringKnowledgeGraph {
     schemaVersion: 1;
@@ -49,6 +50,18 @@ interface GraphInput {
         detail?: string;
         source?: string;
     }>;
+    gateway?: {
+        mode: 'observe' | 'enforce';
+        agentId: string;
+        taskId: string;
+        serverCount: number;
+        toolCount: number;
+        chainValid: boolean;
+        receiptCount: number;
+        chainReason?: string;
+    } | null;
+    receipts?: ExecutionReceipt[];
+    capabilities?: CapabilityGrant[];
     maxFiles?: number;
 }
 export declare function buildEngineeringKnowledgeGraph(input: GraphInput): EngineeringKnowledgeGraph;

package/dist/services/engineering-knowledge-graph.js

@@ -5,6 +5,100 @@ function shortPath(value) {
 function shortLabel(value, limit = 72) {
     return value.length > limit ? `${value.slice(0, limit - 1)}…` : value;
 }
+function addGatewayFoundation(input, repoId, addNode, addEdge) {
+    const gatewayId = 'gateway:rigour-mcp';
+    const policyId = 'policy:rigour-mcp-gateway';
+    const gateway = input.gateway;
+    addNode({
+        id: gatewayId,
+        type: 'gateway',
+        label: 'Trusted MCP gateway',
+        detail: `${gateway.serverCount} servers · ${gateway.toolCount} allowed tools`,
+        state: gateway.mode,
+        repositoryId: input.repository.id,
+        weight: 8,
+        evidence: { chainValid: gateway.chainValid, receiptCount: gateway.receiptCount, chainReason: gateway.chainReason },
+    });
+    addNode({ id: policyId, type: 'policy', label: 'MCP capability policy', detail: `${gateway.mode} mode`, state: gateway.mode, weight: 7 });
+    addEdge(gatewayId, policyId, 'governed_by');
+    addEdge(policyId, repoId, 'protects');
+    const agentId = `agent:${gateway.agentId}`;
+    const taskId = `task:${gateway.taskId}`;
+    addNode({ id: agentId, type: 'agent', label: gateway.agentId, weight: 5 });
+    addNode({ id: taskId, type: 'task', label: gateway.taskId, weight: 4 });
+    addEdge(agentId, taskId, 'performed');
+    return { gatewayId, policyId };
+}
+function addCapabilityEvidence(capabilities, gatewayId, writer) {
+    const { addNode, addEdge } = writer;
+    const selected = capabilities.slice(0, 100);
+    const selectedIds = new Set(selected.map(capability => capability.id));
+    for (const capability of selected) {
+        const capabilityId = `capability:${capability.id}`;
+        const state = capability.used ? 'consumed' : capability.expiresAt < Date.now() ? 'expired' : 'available';
+        addNode({
+            id: capabilityId,
+            type: 'capability',
+            label: `${capability.action} · ${shortLabel(capability.resource, 48)}`,
+            detail: `${capability.subjectId ?? capability.agentId ?? 'unknown actor'} · ${state}`,
+            state,
+            weight: 3,
+            evidence: { expiresAt: capability.expiresAt, issuerId: capability.issuerId, subjectId: capability.subjectId },
+        });
+        addEdge(capabilityId, gatewayId, 'authorized_by');
+        if (capability.parentCapabilityId) {
+            const parentId = `capability:${capability.parentCapabilityId}`;
+            if (!selectedIds.has(capability.parentCapabilityId)) {
+                addNode({ id: parentId, type: 'capability', label: 'Parent capability', detail: 'Referenced by delegated grant', state: 'referenced', weight: 2 });
+            }
+            addEdge(capabilityId, parentId, 'delegated_from');
+        }
+    }
+}
+function addReceiptEvidence(receipts, repositoryId, gatewayId, policyId, writer) {
+    const { addNode, addEdge } = writer;
+    for (const receipt of receipts.slice(-100)) {
+        const actionId = `action:${receipt.id}`;
+        const agentId = `agent:${receipt.action.actorId}`;
+        const taskId = `task:${receipt.action.taskId}`;
+        const outcomeId = `outcome:receipt:${receipt.id}`;
+        addNode({ id: agentId, type: 'agent', label: receipt.action.actorId, weight: 5 });
+        addNode({ id: taskId, type: 'task', label: receipt.action.taskId, weight: 4 });
+        addNode({
+            id: actionId,
+            type: 'action',
+            label: receipt.action.operation,
+            detail: `${receipt.action.resource} · ${receipt.mode}`,
+            state: receipt.simulatedDecision ? `would ${receipt.simulatedDecision}` : receipt.decision,
+            repositoryId,
+            weight: receipt.outcome === 'denied' ? 5 : 3,
+            evidence: {
+                receiptId: receipt.id,
+                outcome: receipt.outcome,
+                mode: receipt.mode,
+                decision: receipt.decision,
+                simulatedDecision: receipt.simulatedDecision,
+                createdAt: receipt.createdAt,
+            },
+        });
+        addNode({ id: outcomeId, type: 'outcome', label: receipt.outcome, detail: receipt.reason, state: receipt.outcome, weight: 3 });
+        addEdge(agentId, actionId, 'performed');
+        addEdge(actionId, taskId, 'belongs_to');
+        addEdge(actionId, gatewayId, 'routes_through');
+        addEdge(actionId, policyId, 'governed_by');
+        addEdge(actionId, outcomeId, 'resulted_in');
+        if (receipt.capabilityId)
+            addEdge(actionId, `capability:${receipt.capabilityId}`, 'authorized_by');
+    }
+}
+function addGatewayEvidence(input, repoId, addNode, addEdge) {
+    if (!input.gateway)
+        return;
+    const { gatewayId, policyId } = addGatewayFoundation(input, repoId, addNode, addEdge);
+    const writer = { addNode, addEdge };
+    addCapabilityEvidence(input.capabilities ?? [], gatewayId, writer);
+    addReceiptEvidence(input.receipts ?? [], input.repository.id, gatewayId, policyId, writer);
+}
 export function buildEngineeringKnowledgeGraph(input) {
     const nodes = new Map();
     const edges = new Map();
@@ -100,6 +194,7 @@ export function buildEngineeringKnowledgeGraph(input) {
         });
         addEdge(repoId, memoryId, 'remembered');
     }
+    addGatewayEvidence(input, repoId, addNode, addEdge);
     for (const event of input.events) {
         if (!event.guidance)
             continue;
@@ -171,7 +266,9 @@ export function buildEngineeringKnowledgeGraph(input) {
             || input.runs.length > 100
             || input.lessons.length > 150
             || (input.patterns?.length ?? 0) > 120
-            || (input.memories?.length ?? 0) > 100,
+            || (input.memories?.length ?? 0) > 100
+            || (input.receipts?.length ?? 0) > 100
+            || (input.capabilities?.length ?? 0) > 100,
         counts,
     };
 }

package/dist/services/engineering-knowledge-graph.test.js

@@ -56,4 +56,21 @@ describe('engineering knowledge graph', () => {
         expect(graph.edges).toContainEqual(expect.objectContaining({ from: 'run:run-1', to: 'advice:run-1', type: 'guided' }));
         expect(graph.edges).toContainEqual(expect.objectContaining({ from: 'pattern:pattern-1', to: 'advice:run-1', type: 'informed' }));
     });
+    it('shows trusted gateway receipts, simulated denials and capability lineage', () => {
+        const graph = buildEngineeringKnowledgeGraph({
+            repository: { id: 'repo-a', name: 'payments' }, events: [], runs: [], lessons: [],
+            gateway: { mode: 'observe', agentId: 'agent-1', taskId: 'task-1', serverCount: 1, toolCount: 2, chainValid: true, receiptCount: 1 },
+            capabilities: [{ id: 'child', action: 'mcp.call', resource: 'mcp://github/get_issue', expiresAt: Date.now() + 1000, policyHash: 'hash', used: false, issuerId: 'owner', subjectId: 'agent-1', parentCapabilityId: 'parent' }],
+            receipts: [{
+                    version: 1, id: 'receipt-1', repositoryId: 'repo-a', mode: 'observe', decision: 'allow', simulatedDecision: 'deny',
+                    reason: 'would deny', policyHash: 'hash', outcome: 'forwarded', createdAt: '2026-01-01T00:00:00Z', digest: 'digest', signature: 'signature',
+                    action: { version: 1, actorId: 'agent-1', taskId: 'task-1', channel: 'mcp', operation: 'github__get_issue', resource: 'mcp://github/get_issue', environment: 'local', sideEffect: 'read', reversibility: 'high', sensitivity: 'normal', blastRadius: 'single-resource' },
+                    capabilityId: 'child',
+                }],
+        });
+        expect(graph.nodes).toContainEqual(expect.objectContaining({ type: 'gateway', evidence: expect.objectContaining({ chainValid: true }) }));
+        expect(graph.nodes).toContainEqual(expect.objectContaining({ type: 'action', state: 'would deny' }));
+        expect(graph.edges).toContainEqual(expect.objectContaining({ from: 'capability:child', to: 'capability:parent', type: 'delegated_from' }));
+        expect(graph.edges).toContainEqual(expect.objectContaining({ from: 'action:receipt-1', to: 'gateway:rigour-mcp', type: 'routes_through' }));
+    });
 });

package/dist/storage/index.d.ts

@@ -13,5 +13,7 @@ export { recordContextEvent, recordModelUsage, setContextCacheRecord, getContext
 export type { ContextEvent, ModelUsage, ContextCacheRecord, CheckpointMetric } from './context-telemetry.js';
 export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId } from './lessons.js';
 export type { ApplicableLessons, InteractionEvidence, LessonRecord, LessonState, LessonVisibility } from './lessons.js';
+export { queueLocalLessonsForTeam } from './team-import.js';
+export type { LocalLessonImportOptions, LocalLessonImportResult } from './team-import.js';
 export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, } from './team-store.js';
 export type { TeamConfiguration, TeamSemanticConfiguration, TeamModeStatus, TeamDoctorResult, SemanticKnowledgeCandidate, SemanticKnowledgeResult, } from './team-store.js';

package/dist/storage/index.js

@@ -9,4 +9,5 @@ export { reinforcePattern, decayPatterns, getStrongPatterns, getPatterns, getHar
 export { checkLocalPatterns, persistAndReinforce, getProjectStats } from './local-memory.js';
 export { recordContextEvent, recordModelUsage, setContextCacheRecord, getContextCacheRecord, listContextCacheRecords, recordCheckpointMetric, getContextEvents, getModelUsages, getCheckpointMetrics } from './context-telemetry.js';
 export { recordInteractionEvidence, countInteractionEvidence, recordInteractionLesson, listLessons, listKnowledgeLessons, getApplicableLessons, transitionLesson, getRepositoryId } from './lessons.js';
+export { queueLocalLessonsForTeam } from './team-import.js';
 export { loadTeamConfiguration, saveTeamConfiguration, initializeTeamSchema, getTeamModeStatus, doctorTeamConnection, syncTeamOutbox, searchTeamKnowledge, backfillTeamEmbeddings, TEAM_CONFIG_PATH, validateTeamDatabaseUrl, } from './team-store.js';

package/dist/storage/lesson-record.d.ts

@@ -0,0 +1,2 @@
+import type { LessonRecord } from './lessons.js';
+export declare function lessonRowToRecord(row: Record<string, unknown>): Promise<LessonRecord>;

package/dist/storage/lesson-record.js

@@ -0,0 +1,20 @@
+import { decryptLocalPayload } from './local-encryption.js';
+export async function lessonRowToRecord(row) {
+    return {
+        id: String(row.id),
+        repositoryId: String(row.repository_id),
+        actorId: row.actor_id ? String(row.actor_id) : undefined,
+        teamId: row.team_id ? String(row.team_id) : undefined,
+        visibility: row.visibility,
+        state: row.state,
+        kind: String(row.kind),
+        subject: String(row.subject),
+        evidence: await decryptLocalPayload(String(row.evidence_json)),
+        confidence: Number(row.confidence),
+        source: String(row.source),
+        supersedesId: row.supersedes_id ? String(row.supersedes_id) : undefined,
+        createdAt: Number(row.created_at),
+        updatedAt: Number(row.updated_at),
+        repositoryName: row.repository_name ? String(row.repository_name) : undefined,
+    };
+}

package/dist/storage/lessons.js

@@ -2,7 +2,8 @@ import { createHash, randomUUID } from 'crypto';
 import fs from 'fs-extra';
 import path from 'path';
 import { openDatabase } from './db.js';
-import { decryptLocalPayload, encryptLocalPayload } from './local-encryption.js';
+import { encryptLocalPayload } from './local-encryption.js';
+import { lessonRowToRecord as rowToLesson } from './lesson-record.js';
 import { loadTeamConfiguration } from './team-store.js';
 export function shouldValidateInteractionLesson(evidence, verifiedSuccessfulOutcomes = 0) {
     return evidence.outcome === 'success'
@@ -92,25 +93,6 @@ async function registerRepository(db, cwd, repositoryId) {
          ON CONFLICT(id) DO UPDATE SET canonical_uri=excluded.canonical_uri,
              display_name=excluded.display_name, last_seen=excluded.last_seen`, repositoryId, canonicalUri, remoteName || path.basename(cwd), Date.now());
 }
-async function rowToLesson(row) {
-    return {
-        id: String(row.id),
-        repositoryId: String(row.repository_id),
-        actorId: row.actor_id ? String(row.actor_id) : undefined,
-        teamId: row.team_id ? String(row.team_id) : undefined,
-        visibility: row.visibility,
-        state: row.state,
-        kind: String(row.kind),
-        subject: String(row.subject),
-        evidence: await decryptLocalPayload(String(row.evidence_json)),
-        confidence: Number(row.confidence),
-        source: String(row.source),
-        supersedesId: row.supersedes_id ? String(row.supersedes_id) : undefined,
-        createdAt: Number(row.created_at),
-        updatedAt: Number(row.updated_at),
-        repositoryName: row.repository_name ? String(row.repository_name) : undefined,
-    };
-}
 export async function recordInteractionLesson(cwd, evidence) {
     const db = await openDatabase();
     if (!db)

package/dist/storage/lessons.test.js

@@ -1,10 +1,16 @@
 import fs from 'fs-extra';
 import os from 'os';
 import path from 'path';
-import { afterEach, describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { openDatabase } from './db.js';
+import { decryptLocalPayload, encryptLocalPayload } from './local-encryption.js';
 import { getRepositoryId, shouldValidateInteractionLesson } from './lessons.js';
+import { queueLocalLessonsForTeam } from './team-import.js';
 const roots = [];
-afterEach(async () => { await Promise.all(roots.splice(0).map((root) => fs.remove(root))); });
+afterEach(async () => {
+    vi.unstubAllEnvs();
+    await Promise.all(roots.splice(0).map((root) => fs.remove(root)));
+});
 describe('getRepositoryId', () => {
     it('uses normalized origin identity instead of a basename', async () => {
         const root = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-repo-id-'));
@@ -48,3 +54,42 @@ describe('interaction lesson validation', () => {
         expect(shouldValidateInteractionLesson({ ...evidence, deterministic: true }, 3)).toBe(false);
     });
 });
+describe('local lesson team import', () => {
+    it('dry-runs, assigns legacy ownership, and queues each lesson version once', async () => {
+        const root = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-team-import-'));
+        roots.push(root);
+        await fs.ensureDir(path.join(root, '.git'));
+        await fs.writeFile(path.join(root, '.git', 'config'), '[remote "origin"]\nurl = https://github.com/acme/service.git\n');
+        vi.stubEnv('RIGOUR_ORGANIZATION_ID', 'acme');
+        vi.stubEnv('RIGOUR_TEAM_ID', 'platform');
+        vi.stubEnv('RIGOUR_ACTOR_ID', 'alice');
+        vi.stubEnv('RIGOUR_TEAM_DATABASE_URL', 'postgresql://alice@127.0.0.1/rigour');
+        vi.stubEnv('RIGOUR_LOCAL_CACHE_KEY', Buffer.alloc(32, 7).toString('base64'));
+        const repositoryId = await getRepositoryId(root);
+        const databasePath = path.join(root, 'rigour.db');
+        const db = await openDatabase(databasePath);
+        expect(db).not.toBeNull();
+        const now = Date.now();
+        await db.run(`INSERT INTO lessons (
+                id, repository_id, actor_id, team_id, visibility, state, kind, subject,
+                evidence_json, confidence, source, created_at, updated_at
+            ) VALUES (?, ?, NULL, NULL, 'personal', 'candidate', 'interaction', ?, ?, 0.3, 'mcp', ?, ?)`, 'lesson-legacy', repositoryId, 'Prefer scoped retrieval.', await encryptLocalPayload({ requestId: 'legacy-request' }), now, now);
+        await db.close();
+        const preview = await queueLocalLessonsForTeam([root], { databasePath, dryRun: true });
+        expect(preview).toMatchObject({ matched: 1, eligible: 1, wouldQueue: 1, queued: 0 });
+        const queued = await queueLocalLessonsForTeam([root], { databasePath });
+        expect(queued).toMatchObject({ matched: 1, eligible: 1, wouldQueue: 1, queued: 1 });
+        const existingOutbox = await openDatabase(databasePath);
+        await existingOutbox.run('UPDATE sync_outbox SET id = ? WHERE entity_id = ?', 'outbox-created-by-normal-learning', 'lesson-legacy');
+        await existingOutbox.close();
+        const repeated = await queueLocalLessonsForTeam([root], { databasePath });
+        expect(repeated).toMatchObject({ matched: 1, eligible: 1, wouldQueue: 0, queued: 0, alreadyQueued: 1 });
+        const verified = await openDatabase(databasePath);
+        const lesson = await verified.get('SELECT actor_id, team_id, visibility, state FROM lessons WHERE id = ?', 'lesson-legacy');
+        expect(lesson).toMatchObject({ actor_id: 'alice', team_id: 'platform', visibility: 'personal', state: 'candidate' });
+        const outbox = await verified.get('SELECT payload_json FROM sync_outbox WHERE entity_id = ?', 'lesson-legacy');
+        const payload = await decryptLocalPayload(outbox.payload_json);
+        expect(payload).toMatchObject({ id: 'lesson-legacy', actorId: 'alice', teamId: 'platform', visibility: 'personal', state: 'candidate' });
+        await verified.close();
+    });
+});

package/dist/storage/team-import.d.ts

@@ -0,0 +1,17 @@
+export interface LocalLessonImportResult {
+    dryRun: boolean;
+    repositoryIds: string[];
+    matched: number;
+    eligible: number;
+    queued: number;
+    wouldQueue: number;
+    alreadyQueued: number;
+    skippedOwnership: number;
+    skippedVisibility: number;
+}
+export interface LocalLessonImportOptions {
+    dryRun?: boolean;
+    databasePath?: string;
+}
+/** Queue pre-team-mode personal lessons without publishing or promoting them. */
+export declare function queueLocalLessonsForTeam(repositoryPaths: string[], options?: LocalLessonImportOptions): Promise<LocalLessonImportResult>;

package/dist/storage/team-import.js

@@ -0,0 +1,97 @@
+import { createHash } from 'node:crypto';
+import { openDatabase } from './db.js';
+import { decryptLocalPayload, encryptLocalPayload } from './local-encryption.js';
+import { lessonRowToRecord } from './lesson-record.js';
+import { getRepositoryId } from './lessons.js';
+import { loadTeamConfiguration } from './team-store.js';
+function createResult(repositoryIds, dryRun) {
+    return {
+        dryRun,
+        repositoryIds,
+        matched: 0,
+        eligible: 0,
+        queued: 0,
+        wouldQueue: 0,
+        alreadyQueued: 0,
+        skippedOwnership: 0,
+        skippedVisibility: 0,
+    };
+}
+function importOutboxId(lesson, config) {
+    const identity = [lesson.id, lesson.updatedAt, config.organizationId, config.teamId, config.actorId].join('\0');
+    return `outbox-import-${createHash('sha256').update(identity).digest('hex')}`;
+}
+async function hasQueuedLessonVersion(db, lesson) {
+    const rows = await db.all(`SELECT payload_json FROM sync_outbox
+         WHERE entity_type = 'lesson' AND entity_id = ?`, lesson.id);
+    for (const row of rows) {
+        try {
+            const payload = await decryptLocalPayload(String(row.payload_json));
+            if (payload.id === lesson.id
+                && payload.updatedAt === lesson.updatedAt
+                && payload.actorId === lesson.actorId
+                && payload.teamId === lesson.teamId
+                && payload.visibility === lesson.visibility)
+                return true;
+        }
+        catch {
+            // Ignore unreadable legacy entries and queue a recoverable replacement.
+        }
+    }
+    return false;
+}
+async function queueLesson(db, row, config, result) {
+    const lesson = await lessonRowToRecord(row);
+    const normalized = { ...lesson, actorId: config.actorId, teamId: config.teamId, visibility: 'personal' };
+    const outboxId = importOutboxId(normalized, config);
+    const existing = await hasQueuedLessonVersion(db, normalized);
+    result.eligible++;
+    if (existing)
+        result.alreadyQueued++;
+    else
+        result.wouldQueue++;
+    if (result.dryRun)
+        return;
+    await db.run('UPDATE lessons SET actor_id = ?, team_id = ? WHERE id = ?', config.actorId, config.teamId, lesson.id);
+    if (existing)
+        return;
+    await db.run(`INSERT INTO sync_outbox (id, operation, entity_type, entity_id, payload_json, created_at)
+         VALUES (?, 'upsert', 'lesson', ?, ?, ?)`, outboxId, normalized.id, await encryptLocalPayload(normalized), Date.now());
+    result.queued++;
+}
+async function queueEligibleRows(db, rows, config, result) {
+    for (const row of rows) {
+        if (row.visibility !== 'personal') {
+            result.skippedVisibility++;
+        }
+        else if (row.actor_id && row.actor_id !== config.actorId) {
+            result.skippedOwnership++;
+        }
+        else {
+            await queueLesson(db, row, config, result);
+        }
+    }
+}
+/** Queue pre-team-mode personal lessons without publishing or promoting them. */
+export async function queueLocalLessonsForTeam(repositoryPaths, options = {}) {
+    if (repositoryPaths.length === 0)
+        throw new Error('At least one repository path is required.');
+    const config = await loadTeamConfiguration();
+    if (!config)
+        throw new Error('Configure PostgreSQL team mode before importing local lessons.');
+    const repositoryIds = [...new Set(await Promise.all(repositoryPaths.map(getRepositoryId)))];
+    const db = await openDatabase(options.databasePath);
+    if (!db)
+        throw new Error('SQLite local cache is unavailable.');
+    const result = createResult(repositoryIds, Boolean(options.dryRun));
+    try {
+        const placeholders = repositoryIds.map(() => '?').join(', ');
+        const rows = await db.all(`SELECT * FROM lessons WHERE repository_id IN (${placeholders}) ORDER BY updated_at ASC`, ...repositoryIds);
+        result.matched = rows.length;
+        await db.transaction(tx => queueEligibleRows(tx, rows, config, result));
+        return result;
+    }
+    finally {
+        await db.close();
+    }
+}

package/dist/storage/team-vector-store.d.ts

@@ -12,8 +12,9 @@ interface EmbeddableLesson {
     kind: string;
     subject: string;
     source: string;
+    state?: string;
 }
-export declare const TEAM_VECTOR_SCHEMA = "\nCREATE EXTENSION IF NOT EXISTS vector;\nCREATE TABLE IF NOT EXISTS rigour.lesson_embeddings (\n    lesson_id TEXT PRIMARY KEY REFERENCES rigour.lessons(id) ON DELETE CASCADE,\n    organization_id TEXT NOT NULL,\n    team_id TEXT NOT NULL,\n    repository_id TEXT NOT NULL,\n    actor_id TEXT NOT NULL,\n    model TEXT NOT NULL,\n    content_hash TEXT NOT NULL,\n    embedding vector(384) NOT NULL,\n    updated_at BIGINT NOT NULL\n);\nALTER TABLE rigour.lesson_embeddings ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS lesson_embeddings_read ON rigour.lesson_embeddings;\nCREATE POLICY lesson_embeddings_read ON rigour.lesson_embeddings FOR SELECT USING (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        JOIN rigour.lessons lesson ON lesson.id = lesson_embeddings.lesson_id\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lesson_embeddings.organization_id\n          AND membership.team_id = lesson_embeddings.team_id\n          AND ((lesson.visibility = 'team' AND lesson.state = 'promoted')\n               OR membership.actor_id = lesson.actor_id)\n    )\n);\nDROP POLICY IF EXISTS lesson_embeddings_write ON rigour.lesson_embeddings;\nCREATE POLICY lesson_embeddings_write ON rigour.lesson_embeddings FOR ALL USING (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lesson_embeddings.organization_id\n          AND membership.team_id = lesson_embeddings.team_id\n          AND membership.actor_id = lesson_embeddings.actor_id\n    )\n) WITH CHECK (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lesson_embeddings.organization_id\n          AND membership.team_id = lesson_embeddings.team_id\n          AND membership.actor_id = lesson_embeddings.actor_id\n    )\n);\nCREATE INDEX IF NOT EXISTS lesson_embeddings_scope\n    ON rigour.lesson_embeddings (organization_id, team_id, model);\nCREATE INDEX IF NOT EXISTS lesson_embeddings_hnsw\n    ON rigour.lesson_embeddings USING hnsw (embedding vector_cosine_ops);\n";
+export declare const TEAM_VECTOR_SCHEMA = "\nCREATE EXTENSION IF NOT EXISTS vector;\nCREATE TABLE IF NOT EXISTS rigour.lesson_embeddings (\n    lesson_id TEXT PRIMARY KEY REFERENCES rigour.lessons(id) ON DELETE CASCADE,\n    organization_id TEXT NOT NULL,\n    team_id TEXT NOT NULL,\n    repository_id TEXT NOT NULL,\n    actor_id TEXT NOT NULL,\n    model TEXT NOT NULL,\n    content_hash TEXT NOT NULL,\n    embedding vector(384) NOT NULL,\n    updated_at BIGINT NOT NULL\n);\nALTER TABLE rigour.lesson_embeddings ENABLE ROW LEVEL SECURITY;\nDROP POLICY IF EXISTS lesson_embeddings_read ON rigour.lesson_embeddings;\nCREATE POLICY lesson_embeddings_read ON rigour.lesson_embeddings FOR SELECT USING (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        JOIN rigour.lessons lesson ON lesson.id = lesson_embeddings.lesson_id\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lesson_embeddings.organization_id\n          AND membership.team_id = lesson_embeddings.team_id\n          AND ((lesson.visibility = 'team' AND lesson.state = 'promoted')\n               OR membership.actor_id = lesson.actor_id)\n    )\n);\nDROP POLICY IF EXISTS lesson_embeddings_write ON rigour.lesson_embeddings;\nCREATE POLICY lesson_embeddings_write ON rigour.lesson_embeddings FOR ALL USING (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lesson_embeddings.organization_id\n          AND membership.team_id = lesson_embeddings.team_id\n          AND membership.actor_id = lesson_embeddings.actor_id\n    )\n) WITH CHECK (\n    EXISTS (\n        SELECT 1 FROM rigour.memberships membership\n        WHERE membership.db_role = current_user\n          AND membership.organization_id = lesson_embeddings.organization_id\n          AND membership.team_id = lesson_embeddings.team_id\n          AND membership.actor_id = lesson_embeddings.actor_id\n    )\n);\nCREATE INDEX IF NOT EXISTS lesson_embeddings_scope\n    ON rigour.lesson_embeddings (organization_id, team_id, model);\nCREATE INDEX IF NOT EXISTS lesson_embeddings_hnsw\n    ON rigour.lesson_embeddings USING hnsw (embedding vector_cosine_ops);\nDELETE FROM rigour.lesson_embeddings embedding\nUSING rigour.lessons lesson\nWHERE lesson.id = embedding.lesson_id\n  AND lesson.state NOT IN ('validated', 'promoted');\n";
 export declare function getTeamSemanticHealth(pool: PgPool, config: TeamConfiguration): Promise<NonNullable<TeamModeStatus['semantic']>>;
 export declare function upsertTeamLessonEmbedding(pool: PgPool, config: TeamConfiguration, lesson: EmbeddableLesson): Promise<boolean>;
 export declare function backfillConfiguredTeamEmbeddings(config: TeamConfiguration, limit: number): Promise<{

package/dist/storage/team-vector-store.js

@@ -47,6 +47,10 @@ CREATE INDEX IF NOT EXISTS lesson_embeddings_scope
     ON rigour.lesson_embeddings (organization_id, team_id, model);
 CREATE INDEX IF NOT EXISTS lesson_embeddings_hnsw
     ON rigour.lesson_embeddings USING hnsw (embedding vector_cosine_ops);
+DELETE FROM rigour.lesson_embeddings embedding
+USING rigour.lessons lesson
+WHERE lesson.id = embedding.lesson_id
+  AND lesson.state NOT IN ('validated', 'promoted');
 `;
 async function createPool(databaseUrl) {
     try {
@@ -67,14 +71,24 @@ export async function getTeamSemanticHealth(pool, config) {
         throw new Error('pgvector team semantics is not configured.');
     const result = await pool.query(`SELECT (SELECT extversion FROM pg_extension WHERE extname = 'vector') AS extversion,
                 to_regclass('rigour.lesson_embeddings') IS NOT NULL AS table_ready,
-                (SELECT COUNT(*)::integer FROM rigour.lesson_embeddings) AS indexed_lessons,
+                (SELECT COUNT(*)::integer
+                   FROM rigour.lesson_embeddings embedding
+                   JOIN rigour.lessons lesson ON lesson.id = embedding.lesson_id
+                  WHERE embedding.organization_id = $1 AND embedding.team_id = $2
+                    AND embedding.model = $3
+                    AND lesson.state IN ('validated', 'promoted')
+                    AND ((lesson.visibility = 'personal' AND lesson.actor_id = $4)
+                         OR (lesson.visibility = 'team' AND lesson.state = 'promoted'))) AS indexed_lessons,
                 (SELECT COUNT(*)::integer
                    FROM rigour.lessons lesson
-                  WHERE lesson.state IN ('validated', 'promoted')
+                  WHERE lesson.organization_id = $1 AND lesson.team_id = $2
+                    AND lesson.state IN ('validated', 'promoted')
+                    AND ((lesson.visibility = 'personal' AND lesson.actor_id = $4)
+                         OR (lesson.visibility = 'team' AND lesson.state = 'promoted'))
                     AND NOT EXISTS (
                         SELECT 1 FROM rigour.lesson_embeddings embedding
-                        WHERE embedding.lesson_id = lesson.id
-                    )) AS missing_lessons`);
+                        WHERE embedding.lesson_id = lesson.id AND embedding.model = $3
+                    )) AS missing_lessons`, [config.organizationId, config.teamId, config.semantic.model, config.actorId]);
     const row = result.rows[0];
     if (!row?.extversion || !row?.table_ready) {
         throw new Error('pgvector semantic storage is configured but the vector extension or lesson_embeddings table is missing.');
@@ -92,6 +106,8 @@ export async function getTeamSemanticHealth(pool, config) {
 export async function upsertTeamLessonEmbedding(pool, config, lesson) {
     if (!config.semantic)
         return false;
+    if (!lesson.state || !['validated', 'promoted'].includes(lesson.state))
+        return false;
     const { generateEmbedding } = await import('../pattern-index/embeddings.js');
     const content = `${lesson.kind}\n${lesson.subject}\n${lesson.source}`;
     const embedding = await generateEmbedding(content);
@@ -113,7 +129,7 @@ export async function backfillConfiguredTeamEmbeddings(config, limit) {
         throw new Error('pgvector team semantics is not configured.');
     const pool = await createPool(config.databaseUrl);
     try {
-        const lessons = await pool.query(`SELECT lesson.id, lesson.repository_id, lesson.actor_id, lesson.kind, lesson.subject, lesson.source
+        const lessons = await pool.query(`SELECT lesson.id, lesson.repository_id, lesson.actor_id, lesson.kind, lesson.subject, lesson.source, lesson.state
                FROM rigour.lessons lesson
               WHERE lesson.organization_id = $1 AND lesson.team_id = $2
                 AND lesson.actor_id = $3

package/dist/storage/team-vector-store.test.js

@@ -1,5 +1,5 @@
-import { describe, expect, it } from 'vitest';
-import { getTeamSemanticHealth } from './team-vector-store.js';
+import { describe, expect, it, vi } from 'vitest';
+import { getTeamSemanticHealth, upsertTeamLessonEmbedding } from './team-vector-store.js';
 const config = {
     organizationId: 'acme',
     teamId: 'platform',
@@ -14,12 +14,12 @@ const config = {
 describe('pgvector team health', () => {
     it('reports extension, model, and embedding coverage', async () => {
         const pool = {
-            query: async () => ({ rows: [{
+            query: vi.fn(async () => ({ rows: [{
                         extversion: '0.8.1',
                         table_ready: true,
                         indexed_lessons: 12,
                         missing_lessons: 3,
-                    }] }),
+                    }] })),
             end: async () => undefined,
         };
         await expect(getTeamSemanticHealth(pool, config)).resolves.toEqual({
@@ -31,6 +31,7 @@ describe('pgvector team health', () => {
             indexedLessons: 12,
             missingLessons: 3,
         });
+        expect(pool.query).toHaveBeenCalledWith(expect.stringContaining("lesson.state IN ('validated', 'promoted')"), ['acme', 'platform', 'Xenova/all-MiniLM-L6-v2', 'alice']);
     });
     it('fails health checks when vector storage is incomplete', async () => {
         const pool = {
@@ -39,4 +40,17 @@ describe('pgvector team health', () => {
         };
         await expect(getTeamSemanticHealth(pool, config)).rejects.toThrow(/vector extension/);
     });
+    it('does not embed unvalidated candidate lessons', async () => {
+        const pool = { query: vi.fn(), end: async () => undefined };
+        await expect(upsertTeamLessonEmbedding(pool, config, {
+            id: 'candidate-1',
+            repositoryId: 'repo-1',
+            actorId: 'alice',
+            kind: 'interaction',
+            subject: 'Unverified suggestion',
+            source: 'mcp',
+            state: 'candidate',
+        })).resolves.toBe(false);
+        expect(pool.query).not.toHaveBeenCalled();
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.2.0",
+  "version": "6.2.2",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -67,11 +67,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.2.0",
-    "@rigour-labs/brain-linux-arm64": "6.2.0",
-    "@rigour-labs/brain-darwin-x64": "6.2.0",
-    "@rigour-labs/brain-win-x64": "6.2.0",
-    "@rigour-labs/brain-linux-x64": "6.2.0"
+    "@rigour-labs/brain-darwin-x64": "6.2.2",
+    "@rigour-labs/brain-darwin-arm64": "6.2.2",
+    "@rigour-labs/brain-linux-arm64": "6.2.2",
+    "@rigour-labs/brain-win-x64": "6.2.2",
+    "@rigour-labs/brain-linux-x64": "6.2.2"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",