@rigour-labs/core 6.4.4 → 6.5.0

package/dist/review-learning/lessons.d.ts

@@ -0,0 +1,52 @@
+import type { Git, ReviewComment } from './acted-on.js';
+export interface ReviewLesson {
+    id: string;
+    text: string;
+    file: string;
+    symbols: string[];
+    state: 'candidate' | 'verified';
+    evidence: Array<{
+        pr: number;
+        comment: string;
+        author: string;
+    }>;
+    createdAt: string;
+    updatedAt: string;
+}
+/** The point of a review comment: its bold title, else its first sentence, without tool output or markup. */
+export declare function lessonText(body: string): string;
+/** Identifiers a lesson is about: those the comment names, then those on the lines it pointed at. */
+export declare function lessonSymbols(body: string, codeLines: string[]): string[];
+export declare function lessonFromComment(git: Git, comment: ReviewComment, at?: string): ReviewLesson | undefined;
+/**
+ * Add lessons to the store. The same lesson again (same text, or the same
+ * file with two shared symbols) adds evidence; acted on in enough PRs, it is
+ * verified.
+ */
+export declare function mergeLessons(existing: ReviewLesson[], incoming: ReviewLesson[]): {
+    lessons: ReviewLesson[];
+    added: number;
+    verified: number;
+};
+export interface ChangeShape {
+    files: string[];
+    /** Identifiers in the changed code. */
+    symbols: Set<string>;
+}
+/**
+ * Lessons that apply to a change, best first. A lesson applies when the change
+ * touches its file, or shares at least two specific identifiers with it; a
+ * shared directory only breaks ties. Lessons about docs, tests or config never
+ * apply to other files.
+ */
+export declare function matchLessons(lessons: ReviewLesson[], change: ChangeShape, options?: {
+    includeCandidates?: boolean;
+    limit?: number;
+}): ReviewLesson[];
+/** RIGOUR_REVIEW_LESSONS points at a lessons file outside the clone (CI, or a team's shared copy). */
+export declare function lessonsPath(cwd: string): string;
+export declare function readLessons(cwd: string): ReviewLesson[];
+export declare function writeLessons(cwd: string, lessons: ReviewLesson[]): void;
+export declare function promoteLesson(cwd: string, id: string): ReviewLesson | undefined;
+/** An identifier specific enough to link two pieces of code: camelCase, snake_case, or long. */
+export declare function isSpecific(symbol: string): boolean;

package/dist/review-learning/lessons.js

@@ -0,0 +1,149 @@
+/**
+ * Review lessons: what a team's acted-on review comments taught, ready to
+ * hand to the next agent before it opens a PR.
+ *
+ * A lesson starts as a candidate with its evidence (PR, comment, author). It
+ * becomes verified only when the same lesson was acted on in two or more PRs,
+ * or a person promotes it. Lessons stay in the repository's .rigour/ folder
+ * (ignored by git) and are sent nowhere except to the user's own model.
+ */
+import crypto from 'crypto';
+import fs from 'fs';
+import path from 'path';
+const STORE = path.join('.rigour', 'review-lessons.json');
+const MAX_TEXT = 220;
+const MAX_SYMBOLS = 8;
+const VERIFY_AT_PRS = 2;
+/** Lessons from these teach about one document, test or config file, not about code that will change again. */
+const NOT_CODE = /(\.(md|mdx|txt|ya?ml|json|lock|snap)$)|(\.(test|spec)\.[cm]?[jt]sx?$)|(^|\/)(__tests__|docs?|migrations|\.github)\//i;
+const NOT_SYMBOLS = new Set(['this', 'that', 'with', 'from', 'return', 'const', 'await', 'async', 'function', 'true', 'false', 'null', 'undefined', 'string', 'number', 'boolean', 'export', 'import', 'type', 'interface', 'else', 'when', 'then', 'should', 'line', 'lines']);
+/** The point of a review comment: its bold title, else its first sentence, without tool output or markup. */
+export function lessonText(body) {
+    const cleaned = body
+        .replace(/<!--[\s\S]*?-->/g, '')
+        .replace(/<details>[\s\S]*?<\/details>/g, '')
+        .replace(/```[\s\S]*?```/g, '')
+        .split('\n')
+        .filter(line => !/^\s*(_[^_]+_\s*\|?\s*)+$/.test(line) && !/^\s*[🏁💡🧩🔇🧰📝⚠️🛠️]/u.test(line))
+        .filter(line => !/^\s*#*\s*\**\s*(low|medium|high|critical)\s+severity\s*\**\s*$/i.test(line))
+        .join('\n');
+    const bold = /\*\*(.+?)\*\*/.exec(cleaned)?.[1]?.trim();
+    const text = bold || cleaned.replace(/\s+/g, ' ').trim().split(/(?<=[.!?])\s/)[0] || '';
+    return text.replace(/[*_]/g, '').slice(0, MAX_TEXT).trim();
+}
+/** Identifiers a lesson is about: those the comment names, then those on the lines it pointed at. */
+export function lessonSymbols(body, codeLines) {
+    const named = [...body.matchAll(/`([A-Za-z_$][\w$.]*)`/g)].map(m => m[1].split('.').pop());
+    const onLines = codeLines.join('\n').match(/[A-Za-z_$][\w$]{3,}/g) ?? [];
+    const symbols = [];
+    for (const symbol of [...named, ...onLines]) {
+        if (!NOT_SYMBOLS.has(symbol.toLowerCase()) && !symbols.includes(symbol))
+            symbols.push(symbol);
+        if (symbols.length >= MAX_SYMBOLS)
+            break;
+    }
+    return symbols;
+}
+export function lessonFromComment(git, comment, at = new Date().toISOString()) {
+    const text = lessonText(comment.body);
+    if (text.length < 12)
+        return undefined;
+    let codeLines = [];
+    try {
+        codeLines = git(['show', `${comment.commit}:${comment.path}`]).split('\n').slice(comment.start - 1, comment.end);
+    }
+    catch {
+        // The file at that commit is unavailable: the comment's own identifiers still describe it.
+    }
+    return {
+        id: crypto.createHash('sha256').update(`${comment.path}\u0000${normalize(text)}`).digest('hex').slice(0, 12),
+        text, file: comment.path, symbols: lessonSymbols(comment.body, codeLines), state: 'candidate',
+        evidence: [{ pr: comment.prNumber, comment: comment.id, author: comment.author }], createdAt: at, updatedAt: at,
+    };
+}
+/**
+ * Add lessons to the store. The same lesson again (same text, or the same
+ * file with two shared symbols) adds evidence; acted on in enough PRs, it is
+ * verified.
+ */
+export function mergeLessons(existing, incoming) {
+    const lessons = existing.map(l => ({ ...l, evidence: [...l.evidence] }));
+    let added = 0;
+    for (const lesson of incoming) {
+        const same = lessons.find(l => l.id === lesson.id || (l.file === lesson.file && shared(l.symbols, lesson.symbols) >= 2));
+        if (!same) {
+            lessons.push(lesson);
+            added++;
+            continue;
+        }
+        for (const e of lesson.evidence)
+            if (!same.evidence.some(x => x.comment === e.comment))
+                same.evidence.push(e);
+        same.updatedAt = lesson.updatedAt;
+    }
+    let verified = 0;
+    for (const lesson of lessons) {
+        if (lesson.state === 'candidate' && new Set(lesson.evidence.map(e => e.pr)).size >= VERIFY_AT_PRS) {
+            lesson.state = 'verified';
+            verified++;
+        }
+    }
+    return { lessons, added, verified };
+}
+/**
+ * Lessons that apply to a change, best first. A lesson applies when the change
+ * touches its file, or shares at least two specific identifiers with it; a
+ * shared directory only breaks ties. Lessons about docs, tests or config never
+ * apply to other files.
+ */
+export function matchLessons(lessons, change, options = {}) {
+    const dirs = new Set(change.files.map(f => path.posix.dirname(f)));
+    const scored = lessons
+        .filter(l => (options.includeCandidates || l.state === 'verified') && !NOT_CODE.test(l.file))
+        .map(l => ({
+        lesson: l,
+        score: (change.files.includes(l.file) ? 3 : 0) + (dirs.has(path.posix.dirname(l.file)) ? 0.5 : 0)
+            + 2 * l.symbols.filter(s => isSpecific(s) && change.symbols.has(s)).length,
+    }))
+        .filter(s => s.score >= 3)
+        .sort((a, b) => b.score - a.score || b.lesson.evidence.length - a.lesson.evidence.length);
+    return scored.slice(0, options.limit ?? 5).map(s => s.lesson);
+}
+/** RIGOUR_REVIEW_LESSONS points at a lessons file outside the clone (CI, or a team's shared copy). */
+export function lessonsPath(cwd) {
+    return process.env.RIGOUR_REVIEW_LESSONS?.trim() || path.join(cwd, STORE);
+}
+export function readLessons(cwd) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(lessonsPath(cwd), 'utf8'));
+        return Array.isArray(parsed?.lessons) ? parsed.lessons : [];
+    }
+    catch {
+        return [];
+    }
+}
+export function writeLessons(cwd, lessons) {
+    const file = lessonsPath(cwd);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify({ version: 1, lessons }, null, 2) + '\n');
+}
+export function promoteLesson(cwd, id) {
+    const lessons = readLessons(cwd);
+    const lesson = lessons.find(l => l.id === id);
+    if (!lesson)
+        return undefined;
+    lesson.state = 'verified';
+    lesson.updatedAt = new Date().toISOString();
+    writeLessons(cwd, lessons);
+    return lesson;
+}
+/** An identifier specific enough to link two pieces of code: camelCase, snake_case, or long. */
+export function isSpecific(symbol) {
+    return /[a-z][A-Z]|[A-Za-z]_[A-Za-z]/.test(symbol) || symbol.length >= 10;
+}
+function normalize(text) {
+    return text.toLowerCase().replace(/[^a-z0-9]+/g, ' ').trim();
+}
+function shared(a, b) {
+    return a.filter(s => b.includes(s)).length;
+}

package/dist/review-learning/repo-rules.d.ts

@@ -0,0 +1,16 @@
+export interface RepoRule {
+    source: string;
+    text: string;
+    /** Paths the rule names (files or directories). */
+    paths: string[];
+    /** Identifiers the rule names. */
+    symbols: string[];
+}
+export declare function readRepoRules(cwd: string): RepoRule[];
+/** One rule per top-level bullet or paragraph; headings and import lines are not rules. */
+export declare function splitRules(source: string, text: string): RepoRule[];
+/** Rules that name a path the change touches, or a specific identifier in it; most specific first. */
+export declare function rulesForChange(rules: RepoRule[], files: string[], symbols: Set<string>): RepoRule[];
+export declare function rulesSection(rules: RepoRule[]): string;
+/** The rules that apply to a diff's changed files and added identifiers. */
+export declare function rulesForDiff(cwd: string, diff: string, enabled?: boolean): RepoRule[];

package/dist/review-learning/repo-rules.js

@@ -0,0 +1,84 @@
+/**
+ * Repository rules that apply to a change.
+ *
+ * A team's real engineering rules usually live in its agent rules files
+ * (AGENTS.md, CLAUDE.md, Cursor rules, Copilot instructions), not in PR
+ * threads: "migrations are append-only", "every send goes through
+ * deliverOrder()". An agent loads the whole file and skims it; the reviewer
+ * is better served by the few rules that name a file or identifier the
+ * change actually touches.
+ */
+import fs from 'fs';
+import path from 'path';
+import { isSpecific } from './lessons.js';
+const RULE_FILES = ['AGENTS.md', 'CLAUDE.md', '.github/copilot-instructions.md'];
+const RULE_DIRS = ['.cursor/rules'];
+const MAX_RULE_CHARS = 600;
+const MAX_RULES = 5;
+export function readRepoRules(cwd) {
+    const files = [
+        ...RULE_FILES.filter(f => fs.existsSync(path.join(cwd, f))),
+        ...RULE_DIRS.flatMap(dir => listRuleFiles(cwd, dir)),
+    ];
+    return files.flatMap(file => splitRules(file, fs.readFileSync(path.join(cwd, file), 'utf8')));
+}
+/** One rule per top-level bullet or paragraph; headings and import lines are not rules. */
+export function splitRules(source, text) {
+    const blocks = [];
+    let current = [];
+    const flush = () => {
+        const block = current.join(' ').replace(/\s+/g, ' ').trim();
+        if (block.length >= 40)
+            blocks.push(block);
+        current = [];
+    };
+    for (const line of text.split('\n')) {
+        if (/^\s*$/.test(line) || /^#{1,6}\s/.test(line) || /^@\S+$/.test(line.trim())) {
+            flush();
+        }
+        else if (/^[-*]\s/.test(line)) {
+            flush();
+            current.push(line.replace(/^[-*]\s+/, ''));
+        }
+        else {
+            current.push(line.trim());
+        }
+    }
+    flush();
+    return blocks.map(block => ({
+        source,
+        text: block.length > MAX_RULE_CHARS ? `${block.slice(0, MAX_RULE_CHARS)}…` : block,
+        paths: [...new Set([...block.matchAll(/`([\w@.~-]+\/[\w./@*-]*)`/g)].map(m => m[1].replace(/\*.*$/, '').replace(/^\.\//, '')))].filter(Boolean),
+        symbols: [...new Set([...block.matchAll(/`([A-Za-z_$][\w$]*)(?:\(\))?`/g)].map(m => m[1]))].filter(isSpecific),
+    }));
+}
+/** Rules that name a path the change touches, or a specific identifier in it; most specific first. */
+export function rulesForChange(rules, files, symbols) {
+    const scored = rules.map(rule => {
+        const pathHits = rule.paths.filter(p => files.some(f => f === p || f.startsWith(p.endsWith('/') ? p : `${p}/`) || f.endsWith(`/${p}`))).length;
+        const symbolHits = rule.symbols.filter(s => symbols.has(s)).length;
+        return { rule, score: 3 * pathHits + 2 * symbolHits };
+    });
+    return scored.filter(s => s.score > 0).sort((a, b) => b.score - a.score).slice(0, MAX_RULES).map(s => s.rule);
+}
+export function rulesSection(rules) {
+    if (rules.length === 0)
+        return '';
+    return `REPOSITORY RULES THAT APPLY (from this repository's own rules files; check the change follows each):\n${rules.map(r => `- [${r.source}] ${r.text}`).join('\n')}`;
+}
+function listRuleFiles(cwd, dir) {
+    try {
+        return fs.readdirSync(path.join(cwd, dir)).filter(f => /\.(md|mdc)$/.test(f)).map(f => `${dir}/${f}`);
+    }
+    catch {
+        return [];
+    }
+}
+/** The rules that apply to a diff's changed files and added identifiers. */
+export function rulesForDiff(cwd, diff, enabled = false) {
+    if (!enabled)
+        return [];
+    const files = [...diff.matchAll(/^\+\+\+ b\/(.+)$/gm)].map(m => m[1].trim());
+    const added = diff.split('\n').filter(line => line.startsWith('+') && !line.startsWith('+++')).join('\n');
+    return rulesForChange(readRepoRules(cwd), files, new Set(added.match(/[A-Za-z_$][\w$]*/g) ?? []));
+}

package/dist/review-learning/repo-rules.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review-learning/repo-rules.test.js

@@ -0,0 +1,39 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { rulesForDiff, rulesSection, splitRules } from './repo-rules.js';
+const AGENTS = `# Conventions
+
+@SHARED.md
+
+- **Migrations are append-only.** Add new files under \`migrations/\`; never edit applied ones.
+- Every outbound send goes through \`deliverOrder()\` in \`src/lib/delivery.ts\`, which checks the permit.
+- Keep components small.
+
+Prefer \`fetchWithTimeout\` over a bare call when talking to partner APIs; a hung request blocks the queue.
+`;
+let repo;
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'repo-rules-'));
+    fs.writeFileSync(path.join(repo, 'AGENTS.md'), AGENTS);
+    fs.mkdirSync(path.join(repo, '.cursor/rules'), { recursive: true });
+    fs.writeFileSync(path.join(repo, '.cursor/rules/ui.mdc'), 'Never set `fullWidth` on `<Button>`; use `maxWidth` caps instead of stretching.\n');
+});
+afterEach(() => { fs.rmSync(repo, { recursive: true, force: true }); });
+const diff = (file, added) => `+++ b/${file}\n@@ -1,0 +1,1 @@\n+${added}\n`;
+describe('repository rules', () => {
+    it('splits a rules file into rules with the paths and specific identifiers they name', () => {
+        const rules = splitRules('AGENTS.md', AGENTS);
+        expect(rules.map(r => r.text.slice(0, 30))).toEqual(['**Migrations are append-only.*', 'Every outbound send goes throu', 'Prefer `fetchWithTimeout` over']);
+        expect(rules[1]).toMatchObject({ paths: ['src/lib/delivery.ts'], symbols: ['deliverOrder'] });
+        expect(rules[0].paths).toEqual(['migrations/']);
+    });
+    it('shows only the rules that name what the change touches, and nothing when disabled', () => {
+        expect(rulesForDiff(repo, diff('migrations/2026_add.sql', 'alter table x;'), true).map(r => r.text.slice(0, 20))).toEqual(['**Migrations are app']);
+        expect(rulesForDiff(repo, diff('src/jobs/send.ts', 'await deliverOrder(order);'), true).map(r => r.text.slice(0, 20))).toEqual(['Every outbound send ']);
+        expect(rulesForDiff(repo, diff('src/ui/List.tsx', 'const x = 1;'), true)).toEqual([]);
+        expect(rulesForDiff(repo, diff('migrations/2026_add.sql', 'x'), false)).toEqual([]);
+        expect(rulesSection(rulesForDiff(repo, diff('src/a.ts', 'await fetchWithTimeout(url);'), true))).toContain('[AGENTS.md] Prefer `fetchWithTimeout`');
+    });
+});

package/dist/review-learning/review-learning.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review-learning/review-learning.test.js

@@ -0,0 +1,104 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { actedOn, gitIn } from './acted-on.js';
+import { learnFromReviews } from './learn-from-reviews.js';
+import { isSpecific, lessonText, matchLessons, mergeLessons, readLessons } from './lessons.js';
+import { lessonsForDiff, lessonsSection } from './team-lessons.js';
+let repo;
+const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' }).trim();
+const write = (body) => fs.writeFileSync(path.join(repo, 'src/orders.ts'), body);
+const commit = (message) => { git('add', '-A'); git('commit', '-qm', message); return git('rev-parse', 'HEAD'); };
+const V1 = 'export async function save(db, order) {\n  await db.insert(order);\n  return order.id;\n}\n';
+const V2 = 'export async function save(db, order) {\n  await db.upsert(order, { onConflict: "id" });\n  return order.id;\n}\n';
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'review-learning-'));
+    git('init', '-q', '-b', 'main');
+    git('config', 'user.email', 't@example.com');
+    git('config', 'user.name', 't');
+    git('config', 'commit.gpgsign', 'false');
+    fs.mkdirSync(path.join(repo, 'src'));
+});
+afterEach(() => { fs.rmSync(repo, { recursive: true, force: true }); });
+const comment = (id, sha, start, body, prNumber = 7) => ({ id, prNumber, path: 'src/orders.ts', start, end: start, commit: sha, body, author: 'reviewer' });
+describe('actedOn', () => {
+    it('keeps a comment whose lines changed before merge, and drops one nobody acted on', () => {
+        write(V1);
+        const reviewed = commit('pr head');
+        write(V2);
+        const merged = commit('address review');
+        const acted = actedOn(gitIn(repo), { number: 7, mergeSha: merged, mergedAt: '', comments: [
+                comment('a', reviewed, 2, '**Use an upsert keyed on `id` so a retry does not duplicate the order.**'),
+                comment('b', reviewed, 3, 'Nit: return the whole order?'),
+            ] });
+        expect(acted.map(c => c.id)).toEqual(['a']);
+    });
+});
+describe('lessons', () => {
+    it('keeps the point of a review comment and drops tool output and markup', () => {
+        const body = '_⚠️ Potential issue_ | _🟠 Major_\n\n**Use an upsert keyed on `id`.**\n\n<details>\n<summary>🏁 Script executed</summary>\nrg -n insert\n</details>';
+        expect(lessonText(body)).toBe('Use an upsert keyed on `id`.');
+        expect(lessonText('Callers retry on timeout, so this insert duplicates orders. Please use upsert.')).toBe('Callers retry on timeout, so this insert duplicates orders.');
+        expect(lessonText('### Medium Severity\n\nThe retry loop never resets `attempt`, so a second failure gives up at once.')).toBe('The retry loop never resets `attempt`, so a second failure gives up at once.');
+    });
+    it('verifies a lesson only when it was acted on in two PRs', () => {
+        const lesson = (pr, comment) => ({
+            id: 'x', text: 'Use upsert', file: 'src/orders.ts', symbols: ['save', 'insert'], state: 'candidate',
+            evidence: [{ pr, comment, author: 'r' }], createdAt: '', updatedAt: '',
+        });
+        const once = mergeLessons([], [lesson(1, 'c1'), lesson(1, 'c2')]);
+        expect(once.lessons[0].state).toBe('candidate');
+        const twice = mergeLessons(once.lessons, [lesson(2, 'c3')]);
+        expect(twice).toMatchObject({ added: 0, verified: 1 });
+        expect(twice.lessons[0].evidence).toHaveLength(3);
+    });
+    it('matches lessons by file, symbols and directory, verified only unless asked', () => {
+        const base = { symbols: ['insert'], evidence: [{ pr: 1, comment: 'c', author: 'r' }], createdAt: '', updatedAt: '' };
+        const lessons = [
+            { ...base, id: '1', text: 'same file', file: 'src/orders.ts', state: 'verified' },
+            { ...base, id: '2', text: 'other dir, two shared symbols', file: 'lib/x.ts', state: 'verified', symbols: ['insertOrder', 'orderId'] },
+            { ...base, id: '6', text: 'a lesson about a runbook', file: 'docs/runbook.md', state: 'verified', symbols: ['insertOrder', 'orderId'] },
+            { ...base, id: '5', text: 'other dir, one generic shared symbol', file: 'lib/z.ts', state: 'verified' },
+            { ...base, id: '3', text: 'candidate', file: 'src/orders.ts', state: 'candidate' },
+            { ...base, id: '4', text: 'unrelated', file: 'lib/y.ts', state: 'verified', symbols: ['other'] },
+        ];
+        const change = { files: ['src/orders.ts'], symbols: new Set(['insert', 'insertOrder', 'orderId']) };
+        expect(matchLessons(lessons, change).map(l => l.id)).toEqual(['2', '1']); // two specific shared names outrank a same-file lesson with only generic ones
+        expect(matchLessons(lessons, change, { includeCandidates: true }).map(l => l.id)).toEqual(['2', '1', '3']);
+    });
+});
+describe('isSpecific', () => {
+    it('counts identifiers that name something, not common words', () => {
+        expect(['orderId', 'max_rows', 'renderTransactionalMessage'].map(isSpecific)).toEqual([true, true, true]);
+        expect(['data', 'error', 'route', 'insert'].map(isSpecific)).toEqual([false, false, false, false]);
+    });
+});
+describe('learnFromReviews', () => {
+    it('reads merged PRs from GitHub, learns from acted-on comments, and shows them for the next change', async () => {
+        write(V1);
+        const reviewed = commit('pr head');
+        write(V2);
+        const merged = commit('address review');
+        const api = 'https://api.github.com/repos/acme/app';
+        const pages = {
+            [`${api}/pulls?state=closed&sort=updated&direction=desc&per_page=100&page=1`]: [
+                { number: 7, merged_at: '2026-09-01T00:00:00Z', merge_commit_sha: merged },
+                { number: 8, merged_at: null, merge_commit_sha: null },
+            ],
+            [`${api}/pulls?state=closed&sort=updated&direction=desc&per_page=100&page=2`]: [],
+            [`${api}/pulls/7/comments?per_page=100`]: [
+                { id: 11, path: 'src/orders.ts', original_line: 2, original_commit_id: reviewed, body: '**Use an upsert keyed on `id` so retries do not duplicate orders.**', user: { login: 'priya' } },
+                { id: 12, path: 'src/orders.ts', original_line: 2, original_commit_id: reviewed, body: 'agreed', in_reply_to_id: 11, user: { login: 'sam' } },
+            ],
+        };
+        const fetchImpl = async (url) => ({ ok: url in pages, status: url in pages ? 200 : 404, json: async () => pages[url] });
+        const result = await learnFromReviews(repo, { token: 't', repo: 'acme/app', fetch: fetchImpl });
+        expect(result).toMatchObject({ prs: 1, comments: 1, actedOn: 1, added: 1, total: 1 });
+        expect(readLessons(repo)[0]).toMatchObject({ file: 'src/orders.ts', text: 'Use an upsert keyed on `id` so retries do not duplicate orders.', evidence: [{ pr: 7, author: 'priya' }] });
+        const diff = '+++ b/src/orders.ts\n@@ -1,0 +1,1 @@\n+  await db.insert(other);\n';
+        expect(lessonsForDiff(repo, diff, 'verified')).toEqual([]); // one PR is not enough to verify
+        expect(lessonsSection(lessonsForDiff(repo, diff, 'all'))).toContain('src/orders.ts: Use an upsert keyed on `id` so retries do not duplicate orders. (acted on in PR #7)');
+    });
+});

package/dist/review-learning/team-lessons.d.ts

@@ -0,0 +1,4 @@
+import { type ReviewLesson } from './lessons.js';
+export type LessonMode = 'verified' | 'all' | 'off';
+export declare function lessonsForDiff(cwd: string, diff: string, mode?: LessonMode): ReviewLesson[];
+export declare function lessonsSection(lessons: ReviewLesson[]): string;

package/dist/review-learning/team-lessons.js

@@ -0,0 +1,24 @@
+/**
+ * The team's review lessons that apply to a change, for the reviewer (an
+ * agent or a model) to check before the PR: "your team has asked for this
+ * before".
+ */
+import { parseDiff } from '../utils/diff.js';
+import { matchLessons, readLessons } from './lessons.js';
+export function lessonsForDiff(cwd, diff, mode = 'off') {
+    if (mode === 'off')
+        return [];
+    const lessons = readLessons(cwd);
+    if (lessons.length === 0)
+        return [];
+    const files = Object.keys(parseDiff(diff));
+    const added = diff.split('\n').filter(line => line.startsWith('+') && !line.startsWith('+++')).join('\n');
+    const symbols = new Set(added.match(/[A-Za-z_$][\w$]{3,}/g) ?? []);
+    return matchLessons(lessons, { files, symbols }, { includeCandidates: mode === 'all' });
+}
+export function lessonsSection(lessons) {
+    if (lessons.length === 0)
+        return '';
+    const lines = lessons.map(l => `- ${l.file}: ${l.text} (acted on in PR ${[...new Set(l.evidence.map(e => `#${e.pr}`))].join(', ')})`);
+    return `TEAM LESSONS (this team asked for these in past reviews; check whether the change repeats any):\n${lines.join('\n')}`;
+}

package/dist/semantic/rules/credential-redirect.js

@@ -15,6 +15,8 @@ import { originsOf, propertyValues } from '../origins.js';
 const CREDENTIAL_HEADER = /^(?:x-[\w-]*(?:token|secret|key|signature|password|auth[\w-]*)|[\w-]*(?:api[-_]?key|secret|access[-_]?token|private[-_]?token))$/i;
 /** Removed by fetch (or not settable) on a cross-origin redirect. */
 const STRIPPED_ON_REDIRECT = /^(?:authorization|proxy-authorization|cookie)$/i;
+/** Named like a key but not a secret: identifiers for deduplication, routing, caching and tracing. */
+const NOT_A_CREDENTIAL = /idempoten|request[-_]?id|correlation|trace|dedup|cache[-_]?key|partition[-_]?key|routing[-_]?key|public[-_]?key|key[-_]?id$/i;
 const SECRET_ENV = /SECRET|TOKEN|API_?KEY|PASSWORD|PRIVATE_KEY/i;
 export const credentialRedirect = {
     id: 'credential-redirect',
@@ -155,7 +157,8 @@ function credentialHeader(checker, headers) {
             const header = propertyNameText(prop.name);
             if (!header || STRIPPED_ON_REDIRECT.test(header))
                 continue;
-            if (CREDENTIAL_HEADER.test(header) || readsSecretEnv(prop.initializer))
+            const named = CREDENTIAL_HEADER.test(header) && !NOT_A_CREDENTIAL.test(header);
+            if (named || readsSecretEnv(prop.initializer))
                 return { header, node: prop };
         }
     }

package/dist/settings.js

@@ -123,10 +123,13 @@ export function resolveDeepOptions(cliOptions) {
         result.modelName = cliOptions.modelName;
     }
     // 4. Resolve API key
-    // CLI flag takes highest precedence
+    // CLI flag takes highest precedence, then RIGOUR_API_KEY (CI secrets: never on a command line)
     if (cliOptions.apiKey) {
         result.apiKey = cliOptions.apiKey;
     }
+    else if (process.env.RIGOUR_API_KEY?.trim()) {
+        result.apiKey = process.env.RIGOUR_API_KEY.trim();
+    }
     else if (settings.providers) {
         // Otherwise look up provider key in settings.providers
         const normalizedProvider = normalizeProviderName(selectedProvider);

package/dist/templates/universal-config.js

@@ -154,7 +154,7 @@ export const UNIVERSAL_CONFIG = {
         promise_safety: {
             enabled: true,
             check_unhandled_then: true,
-            check_unsafe_parse: true,
+            check_unsafe_parse: false,
             check_async_without_await: true,
             check_unsafe_fetch: true,
             ignore_patterns: [],
@@ -191,8 +191,8 @@ export const UNIVERSAL_CONFIG = {
         },
         governance: {
             enabled: true,
-            enforce_memory: true,
-            enforce_skills: true,
+            enforce_memory: false,
+            enforce_skills: false,
             block_native_memory: true,
             protected_memory_paths: [
                 'CLAUDE.md', '.claude/CLAUDE.md',
@@ -275,11 +275,15 @@ export const UNIVERSAL_CONFIG = {
         fast_gates: ['hallucinated-imports', 'phantom-apis', 'deprecated-apis', 'promise-safety', 'security-patterns', 'file-size'],
         timeout_ms: 5000,
         block_on_failure: false,
+        require_review_ack: false,
         dlp: true,
     },
     output: {
         report_path: 'rigour-report.json',
     },
+    review: {
+        include_heuristics: false,
+    },
     planned: [],
     ignore: [],
 };