@rigour-labs/core 6.5.3 → 6.5.4

package/README.md

@@ -46,7 +46,7 @@ Rigour's deep analysis is not a wrapper around a generic LLM. The model operates
 2. **Interpret** — the model receives structured facts (not raw source), focuses on SOLID, design patterns, language idioms, architecture. Constrained input prevents hallucination.
 3. **Verify** — every LLM finding is cross-referenced against all five signal streams. Wrong line numbers, phantom patterns, non-existent functions → discarded. Only verified findings with confidence scores reach the report.
 
-The lite and deep tiers are fine-tuned via the [DriftBench RLAIF pipeline](https://github.com/rigour-labs/driftbench), where the five signal streams serve as the teacher signal. The max tier (Qwen2.5-Coder-7B) runs the stock model until a fine-tune passes the evaluation gate.
+Deep review is built for frontier models: your own key, or the coding agent's own model. The small local models (lite and deep tiers fine-tuned via the [DriftBench RLAIF pipeline](https://github.com/rigour-labs/driftbench); max is the stock Qwen2.5-Coder-7B) remain available offline but are no longer developed.
 
 ### Temporal Drift Engine (v5.1)
 

package/dist/deep/risk.d.ts

@@ -38,4 +38,10 @@ export declare function findFunction(cwd: string, file: string, name: string): {
     start: number;
     end: number;
 } | undefined;
+/**
+ * What a review record is bound to: the function's exact source. Collapsing whitespace once let
+ * `"a  b"` and `"a b"` share a hash, so a string changed after review still counted as reviewed.
+ * Only line endings are normalised (a Windows checkout is the same code); any other change,
+ * formatting included, asks for a new review.
+ */
 export declare function functionHash(text: string): string;

package/dist/deep/risk.js

@@ -92,8 +92,14 @@ export function findFunction(cwd, file, name) {
     visit(sourceFile);
     return found;
 }
+/**
+ * What a review record is bound to: the function's exact source. Collapsing whitespace once let
+ * `"a  b"` and `"a b"` share a hash, so a string changed after review still counted as reviewed.
+ * Only line endings are normalised (a Windows checkout is the same code); any other change,
+ * formatting included, asks for a new review.
+ */
 export function functionHash(text) {
-    return crypto.createHash('sha256').update(text.replace(/\s+/g, ' ').trim()).digest('hex');
+    return crypto.createHash('sha256').update(text.replace(/\r\n/g, '\n')).digest('hex');
 }
 const GUARD = /\b(?:if|else|return|throw|break|continue|catch)\b|\?\?|\?\./g;
 function guards(lines) {

package/dist/deep/risk.test.js

@@ -2,7 +2,7 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { rankChangedFunctions, scoreRisk } from './risk.js';
+import { functionHash, rankChangedFunctions, scoreRisk } from './risk.js';
 import { routeFiles } from './router.js';
 let dir;
 beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'risk-')); });
@@ -61,3 +61,14 @@ describe('routeFiles', () => {
         expect(stale.stats).toMatchObject({ routed: 1, already_reviewed: 0 });
     });
 });
+describe('functionHash', () => {
+    it('changes when anything inside the function changes, strings included', () => {
+        const a = 'function f() { return "a  b"; }';
+        const b = 'function f() { return "a b"; }';
+        expect(functionHash(a)).not.toBe(functionHash(b));
+        expect(functionHash('function f() { return `x ${y}`; }')).not.toBe(functionHash('function f() { return `x  ${y}`; }'));
+    });
+    it('treats a Windows checkout of the same code as the same code', () => {
+        expect(functionHash('function f() {\r\n  return 1;\r\n}')).toBe(functionHash('function f() {\n  return 1;\n}'));
+    });
+});

package/dist/firewall/arbitration-token.d.ts

@@ -1,8 +1,17 @@
 /**
- * One-time arbitration tokens — bind Studio approve/reject to the requesting MCP process.
+ * One-time arbitration tokens — bind a Studio approve/reject to the MCP process that asked.
+ *
+ * The token lives only in the requesting process's memory and in a store outside the workspace
+ * (never in .rigour/ or the event log, which agents write). Studio consumes it once and signs the
+ * decision with it; the requester accepts only a decision whose signature verifies, so appending
+ * a decision line to .rigour/events.jsonl approves nothing.
  */
+export type ArbitrationDecision = 'approve' | 'reject';
 export declare function issueArbitrationToken(cwd: string, requestId: string, ttlMs?: number): Promise<string>;
 /**
- * Consume a one-time token. Returns false if missing, expired, or mismatched.
+ * Studio side: consume the request's token once and sign the human's decision with it.
+ * Null when the request is unknown, expired or already decided.
  */
-export declare function consumeArbitrationToken(cwd: string, requestId: string, token: string | undefined): Promise<boolean>;
+export declare function signArbitrationDecision(cwd: string, requestId: string, decision: ArbitrationDecision): Promise<string | null>;
+/** Requester side: true only for a decision signed with the token this process issued. */
+export declare function verifyArbitrationDecision(token: string, requestId: string, decision: unknown, proof: unknown): boolean;

package/dist/firewall/arbitration-token.js

@@ -1,26 +1,29 @@
 /**
- * One-time arbitration tokens — bind Studio approve/reject to the requesting MCP process.
+ * One-time arbitration tokens — bind a Studio approve/reject to the MCP process that asked.
+ *
+ * The token lives only in the requesting process's memory and in a store outside the workspace
+ * (never in .rigour/ or the event log, which agents write). Studio consumes it once and signs the
+ * decision with it; the requester accepts only a decision whose signature verifies, so appending
+ * a decision line to .rigour/events.jsonl approves nothing.
  */
-import { randomBytes, timingSafeEqual } from 'crypto';
+import { createHmac, randomBytes, timingSafeEqual } from 'crypto';
 import fs from 'fs-extra';
 import path from 'path';
+import { repoStateDir } from '../utils/user-state.js';
 function storePath(cwd) {
-    return path.join(cwd, '.rigour', 'arbitration-tokens.json');
+    return path.join(repoStateDir(cwd), 'arbitration-tokens.json');
 }
 async function readStore(cwd) {
-    const p = storePath(cwd);
-    if (!(await fs.pathExists(p)))
-        return {};
     try {
-        return await fs.readJson(p);
+        return await fs.readJson(storePath(cwd));
     }
     catch {
         return {};
     }
 }
 async function writeStore(cwd, store) {
-    await fs.ensureDir(path.join(cwd, '.rigour'));
-    await fs.writeJson(storePath(cwd), store, { spaces: 2 });
+    await fs.ensureDir(path.dirname(storePath(cwd)), { mode: 0o700 });
+    await fs.writeJson(storePath(cwd), store, { spaces: 2, mode: 0o600 });
 }
 export async function issueArbitrationToken(cwd, requestId, ttlMs = 60_000) {
     const token = randomBytes(24).toString('hex');
@@ -34,25 +37,29 @@ export async function issueArbitrationToken(cwd, requestId, ttlMs = 60_000) {
     await writeStore(cwd, store);
     return token;
 }
+function decisionProof(token, requestId, decision) {
+    return createHmac('sha256', token).update(`${requestId}:${decision}`).digest('hex');
+}
 /**
- * Consume a one-time token. Returns false if missing, expired, or mismatched.
+ * Studio side: consume the request's token once and sign the human's decision with it.
+ * Null when the request is unknown, expired or already decided.
  */
-export async function consumeArbitrationToken(cwd, requestId, token) {
-    if (!token || !requestId)
-        return false;
+export async function signArbitrationDecision(cwd, requestId, decision) {
+    if (!requestId)
+        return null;
     const store = await readStore(cwd);
     const entry = store[requestId];
     if (!entry)
-        return false;
-    if (Date.now() > entry.expiresAt) {
-        delete store[requestId];
-        await writeStore(cwd, store);
-        return false;
-    }
-    const a = Buffer.from(entry.token);
-    const b = Buffer.from(token);
-    const ok = a.length === b.length && timingSafeEqual(a, b);
+        return null;
     delete store[requestId];
     await writeStore(cwd, store);
-    return ok;
+    return Date.now() > entry.expiresAt ? null : decisionProof(entry.token, requestId, decision);
+}
+/** Requester side: true only for a decision signed with the token this process issued. */
+export function verifyArbitrationDecision(token, requestId, decision, proof) {
+    if ((decision !== 'approve' && decision !== 'reject') || typeof proof !== 'string')
+        return false;
+    const expected = Buffer.from(decisionProof(token, requestId, decision));
+    const given = Buffer.from(proof);
+    return expected.length === given.length && timingSafeEqual(expected, given);
 }

package/dist/firewall/attestation.d.ts

@@ -30,9 +30,14 @@ export declare function createAttestation(cwd: string, input: {
 export declare function verifyAttestation(cwd: string, bundle: AttestationBundle): Promise<boolean>;
 export declare function loadLatestAttestation(cwd: string): Promise<AttestationBundle | null>;
 /**
- * CI admission: valid signature, PASS gates, bound commit/tree, fresh, non-workspace-key unless allowed.
+ * CI admission. Admits only a bundle that is signed with a key outside the workspace, records PASS
+ * gates, is fresh, is bound to this checkout (commit or tree, and at least one must be present and
+ * match), whose artifact digest recomputes from the files here, and, when the caller names the
+ * policy it requires, was produced under that policy.
  */
-export declare function admitForCi(cwd: string): Promise<{
+export declare function admitForCi(cwd: string, options?: {
+    policyHash?: string;
+}): Promise<{
     admit: boolean;
     reason: string;
 }>;

package/dist/firewall/attestation.js

@@ -2,18 +2,18 @@
  * Signed attestation bundles for completed transactions.
  * Keys prefer env / home directory — not agent-writable workspace keys for CI admit.
  */
-import { createHash, createHmac, randomBytes } from 'crypto';
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'crypto';
 import fs from 'fs-extra';
-import os from 'os';
 import path from 'path';
 import { execa } from 'execa';
+import { rigourUserDir } from '../utils/user-state.js';
 const KEY_FILE = 'attestation.key';
 export async function resolveAttestationKey(cwd) {
     const envKey = process.env.RIGOUR_ATTESTATION_KEY;
     if (envKey && envKey.length >= 32) {
         return { key: Buffer.from(envKey, 'utf8'), source: 'env' };
     }
-    const homeKeyPath = path.join(os.homedir(), '.rigour', KEY_FILE);
+    const homeKeyPath = path.join(rigourUserDir(), KEY_FILE);
     if (await fs.pathExists(homeKeyPath)) {
         return { key: await fs.readFile(homeKeyPath), source: 'home' };
     }
@@ -22,7 +22,7 @@ export async function resolveAttestationKey(cwd) {
         return { key: await fs.readFile(workspaceKeyPath), source: 'workspace' };
     }
     // Create home key by default (outside agent workspace)
-    await fs.ensureDir(path.join(os.homedir(), '.rigour'));
+    await fs.ensureDir(rigourUserDir());
     const key = randomBytes(32);
     await fs.writeFile(homeKeyPath, key, { mode: 0o600 });
     return { key, source: 'home' };
@@ -130,10 +130,11 @@ export async function createAttestation(cwd, input) {
 export async function verifyAttestation(cwd, bundle) {
     const { key } = await resolveAttestationKey(cwd);
     const { signature, signedAt, ...rest } = bundle;
-    const expected = createHmac('sha256', key)
+    const expected = Buffer.from(createHmac('sha256', key)
         .update(payloadForSign(rest) + signedAt)
-        .digest('hex');
-    return expected === signature;
+        .digest('hex'));
+    const given = Buffer.from(String(signature ?? ''));
+    return expected.length === given.length && timingSafeEqual(expected, given);
 }
 export async function loadLatestAttestation(cwd) {
     const p = path.join(cwd, '.rigour', 'attestation-latest.json');
@@ -147,9 +148,12 @@ export async function loadLatestAttestation(cwd) {
     }
 }
 /**
- * CI admission: valid signature, PASS gates, bound commit/tree, fresh, non-workspace-key unless allowed.
+ * CI admission. Admits only a bundle that is signed with a key outside the workspace, records PASS
+ * gates, is fresh, is bound to this checkout (commit or tree, and at least one must be present and
+ * match), whose artifact digest recomputes from the files here, and, when the caller names the
+ * policy it requires, was produced under that policy.
  */
-export async function admitForCi(cwd) {
+export async function admitForCi(cwd, options = {}) {
     const { source } = await resolveAttestationKey(cwd);
     if (source === 'workspace' && process.env.RIGOUR_ALLOW_WORKSPACE_ATTESTATION_KEY !== '1') {
         return {
@@ -168,30 +172,47 @@ export async function admitForCi(cwd) {
     if (bundle.gateResults.status !== 'PASS') {
         return { admit: false, reason: `Gates not PASS (${bundle.gateResults.status})` };
     }
-    if (!bundle.treeDigest && (!bundle.filesUsed || bundle.filesUsed.length === 0)) {
-        return { admit: false, reason: 'Attestation missing treeDigest and filesUsed' };
-    }
-    if (!bundle.artifactDigest || bundle.artifactDigest.length < 16) {
-        return { admit: false, reason: 'Attestation artifactDigest missing or trivial' };
+    const requiredPolicy = options.policyHash ?? process.env.RIGOUR_REQUIRED_POLICY_HASH;
+    if (requiredPolicy && bundle.policyHash !== requiredPolicy) {
+        return { admit: false, reason: `Attestation policy ${bundle.policyHash} is not the required ${requiredPolicy}` };
     }
     const maxAgeMs = Number(process.env.RIGOUR_ATTESTATION_MAX_AGE_MS || 24 * 60 * 60 * 1000);
     const age = Date.now() - Date.parse(bundle.signedAt);
     if (!Number.isFinite(age) || age < 0 || age > maxAgeMs) {
         return { admit: false, reason: 'Attestation expired or has invalid signedAt' };
     }
-    const headSha = await getGitCommitSha(cwd);
-    if (bundle.commitSha && headSha && bundle.commitSha !== headSha) {
-        return {
-            admit: false,
-            reason: `Attestation commitSha ${bundle.commitSha.slice(0, 8)}≠ HEAD ${headSha.slice(0, 8)}`,
-        };
+    const binding = await checkBinding(cwd, bundle);
+    if (binding)
+        return { admit: false, reason: binding };
+    if (await recomputeArtifactDigest(cwd, bundle) !== bundle.artifactDigest) {
+        return { admit: false, reason: 'Attestation artifactDigest does not match the files in this checkout' };
     }
-    const headTree = await getGitTreeDigest(cwd);
-    if (bundle.treeDigest && headTree && bundle.treeDigest !== headTree) {
-        return {
-            admit: false,
-            reason: `Attestation treeDigest mismatch vs HEAD tree`,
-        };
-    }
-    return { admit: true, reason: 'Valid attestation with PASS gates and bound tree/commit' };
+    return { admit: true, reason: 'Valid attestation with PASS gates, bound to this checkout, artifacts verified' };
+}
+/** Why the bundle is not bound to this checkout, or null when it is. A bundle bound to nothing is refused. */
+async function checkBinding(cwd, bundle) {
+    if (!bundle.commitSha && !bundle.treeDigest)
+        return 'Attestation is bound to no commit or tree';
+    const [headSha, headTree] = await Promise.all([getGitCommitSha(cwd), getGitTreeDigest(cwd)]);
+    if (bundle.commitSha && bundle.commitSha !== headSha) {
+        return `Attestation commitSha ${bundle.commitSha.slice(0, 8)} is not HEAD ${(headSha ?? 'none').slice(0, 8)}`;
+    }
+    if (bundle.treeDigest && bundle.treeDigest !== headTree)
+        return 'Attestation treeDigest mismatch vs HEAD tree';
+    return null;
+}
+/** The digest createAttestation would compute for this checkout: the named files' contents, or the tree. */
+async function recomputeArtifactDigest(cwd, bundle) {
+    const files = bundle.filesUsed ?? [];
+    if (files.length === 0)
+        return createHash('sha256').update(`tree:${bundle.treeDigest ?? ''}`).digest('hex');
+    const contents = new Map();
+    for (const f of files) {
+        const abs = path.resolve(cwd, f);
+        if (!abs.startsWith(path.resolve(cwd) + path.sep))
+            continue; // never read outside the checkout
+        if (await fs.pathExists(abs))
+            contents.set(f, await fs.readFile(abs, 'utf-8'));
+    }
+    return computeArtifactDigest(files, contents);
 }

package/dist/firewall/trust-boundaries.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/firewall/trust-boundaries.test.js

@@ -0,0 +1,64 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { issueArbitrationToken, signArbitrationDecision, verifyArbitrationDecision } from './arbitration-token.js';
+import { admitForCi, createAttestation } from './attestation.js';
+let repo;
+const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' });
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'trust-'));
+    git('init', '-q', '-b', 'main');
+    git('config', 'user.email', 't@example.com');
+    git('config', 'user.name', 't');
+    git('config', 'commit.gpgsign', 'false');
+    fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 1;\n');
+    git('add', '-A');
+    git('commit', '-qm', 'init');
+});
+afterEach(() => fs.rmSync(repo, { recursive: true, force: true }));
+describe('human arbitration', () => {
+    it('accepts only a decision signed with the issued token, once', async () => {
+        const token = await issueArbitrationToken(repo, 'r1');
+        expect(fs.existsSync(path.join(repo, '.rigour', 'arbitration-tokens.json'))).toBe(false);
+        // A line any process can append to the event log carries no valid proof.
+        expect(verifyArbitrationDecision(token, 'r1', 'approve', undefined)).toBe(false);
+        expect(verifyArbitrationDecision(token, 'r1', 'approve', 'f'.repeat(64))).toBe(false);
+        const proof = await signArbitrationDecision(repo, 'r1', 'approve');
+        expect(verifyArbitrationDecision(token, 'r1', 'approve', proof)).toBe(true);
+        expect(verifyArbitrationDecision(token, 'r1', 'reject', proof)).toBe(false);
+        expect(await signArbitrationDecision(repo, 'r1', 'approve')).toBeNull();
+    });
+});
+describe('CI admission', () => {
+    const tx = (over = {}) => ({
+        id: 'tx1', agentId: 'agent', scope: ['**/*'], policyHash: 'policy-a', capabilitiesIssued: [], filesChanged: ['a.ts'], ...over,
+    });
+    const pass = { status: 'PASS', failedGates: [] };
+    it('admits a fresh, bound bundle whose files are unchanged', async () => {
+        await createAttestation(repo, { transaction: tx(), gateResults: pass });
+        expect(await admitForCi(repo)).toMatchObject({ admit: true });
+    });
+    it('refuses when an attested file differs from what was signed, even at the same commit', async () => {
+        await createAttestation(repo, { transaction: tx(), gateResults: pass });
+        fs.writeFileSync(path.join(repo, 'a.ts'), 'export const a = 2;\n'); // HEAD and its tree are unchanged
+        expect(await admitForCi(repo)).toMatchObject({ admit: false, reason: expect.stringContaining('artifactDigest') });
+    });
+    it('refuses a bundle produced under another policy than the one required', async () => {
+        await createAttestation(repo, { transaction: tx(), gateResults: pass });
+        expect(await admitForCi(repo, { policyHash: 'policy-b' })).toMatchObject({ admit: false });
+        expect(await admitForCi(repo, { policyHash: 'policy-a' })).toMatchObject({ admit: true });
+    });
+    it('refuses a bundle bound to no commit or tree', async () => {
+        const noRepo = fs.mkdtempSync(path.join(os.tmpdir(), 'trust-norepo-'));
+        try {
+            fs.writeFileSync(path.join(noRepo, 'a.ts'), 'export const a = 1;\n');
+            await createAttestation(noRepo, { transaction: tx(), gateResults: pass });
+            expect(await admitForCi(noRepo)).toMatchObject({ admit: false, reason: 'Attestation is bound to no commit or tree' });
+        }
+        finally {
+            fs.rmSync(noRepo, { recursive: true, force: true });
+        }
+    });
+});

package/dist/gates/deep-analysis.d.ts

@@ -15,6 +15,7 @@ import { Gate, GateContext } from './base.js';
 import { Failure, Provenance, DeepOptions } from '../types/index.js';
 import type { InferenceUsage } from '../inference/types.js';
 import { type RouterPolicy, type RouterStats } from '../deep/router.js';
+import { reviewedKeys } from '../review/ledger.js';
 import { type LessonMode } from '../review-learning/team-lessons.js';
 export interface DeepGateConfig {
     options: DeepOptions;
@@ -88,3 +89,8 @@ export declare class DeepAnalysisGate extends Gate {
 /** Per-call options; unset config falls back to per-provider defaults. */
 /** Per-call inference timeout: a local 7B reads a file with its reference pack far slower than the small tiers. */
 export declare function defaultTimeout(options: DeepOptions): number;
+/**
+ * Functions the router may skip as already reviewed: what agents recorded (the ledger and
+ * reviewed.json), unless the run is independent, as an enforcing check is.
+ */
+export declare function trustedReviews(cwd: string, options: Pick<DeepOptions, 'independent'>): ReturnType<typeof reviewedKeys>;

package/dist/gates/deep-analysis.js

@@ -179,7 +179,7 @@ export class DeepAnalysisGate extends Gate {
         const { options } = this.config;
         if (!isCloud(options) || this.config.router?.enabled === false || !options.focusLines)
             return facts;
-        const routed = routeFiles(cwd, facts.map(f => f.path), options.focusLines, options.removedLines, this.config.router, reviewedKeys(cwd));
+        const routed = routeFiles(cwd, facts.map(f => f.path), options.focusLines, options.removedLines, this.config.router, trustedReviews(cwd, options));
         this.outcome.router = routed.stats;
         if (routed.stats.files_skipped > 0) {
             this.config.onProgress?.(`  Router: ${routed.stats.routed} of ${routed.stats.functions} changed function(s) to the model; ${routed.stats.files_skipped} file(s) left to the gates.`);
@@ -302,3 +302,10 @@ async function withTimeout(promise, ms, message) {
         clearTimeout(timer);
     }
 }
+/**
+ * Functions the router may skip as already reviewed: what agents recorded (the ledger and
+ * reviewed.json), unless the run is independent, as an enforcing check is.
+ */
+export function trustedReviews(cwd, options) {
+    return options.independent ? [] : reviewedKeys(cwd);
+}

package/dist/gates/trusted-reviews.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/trusted-reviews.test.js

@@ -0,0 +1,16 @@
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { trustedReviews } from './deep-analysis.js';
+let cwd;
+afterEach(() => fs.rmSync(cwd, { recursive: true, force: true }));
+describe('trustedReviews', () => {
+    it('lets a normal run skip what agents recorded as reviewed, and an independent run skip nothing', () => {
+        cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'trusted-reviews-'));
+        fs.mkdirSync(path.join(cwd, '.rigour'));
+        fs.writeFileSync(path.join(cwd, '.rigour', 'reviewed.json'), JSON.stringify({ version: 1, entries: [{ file: 'src/a.ts', function: 'f', hash: 'h', reviewer: 'agent', verdict: 'no_issue' }] }));
+        expect(trustedReviews(cwd, {}).map(r => r.function)).toEqual(['f']);
+        expect(trustedReviews(cwd, { independent: true })).toEqual([]);
+    });
+});

package/dist/hooks/checker.js

@@ -110,6 +110,11 @@ export async function runHookChecker(options) {
             if (!resolved) {
                 continue;
             }
+            // Before ignore patterns: rigour.yml commonly ignores .rigour/ for scanning, not for writes.
+            if (isRigourState(resolved.relPath)) {
+                failures.push(rigourStateFailure(resolved.relPath));
+                continue;
+            }
             // Respect rigour.yml ignore patterns
             if (isIgnored(resolved.relPath, ignorePatterns)) {
                 continue;
@@ -270,6 +275,23 @@ function checkCommandInjection(line, i, relPath, failures) {
         });
     }
 }
+// ── Rigour's own state (always on) ────────────────────────────────
+/**
+ * .rigour/ holds what decides a review: dismissals, check outcomes, learned rules, the review
+ * ledger, operator scopes. Rigour writes it through its own commands and tools, never through
+ * the agent's edit tool, so an agent edit there is refused whatever rigour.yml says.
+ */
+function isRigourState(relPath) {
+    return relPath.replace(/\\/g, '/').startsWith('.rigour/');
+}
+function rigourStateFailure(relPath) {
+    return {
+        gate: 'file-guard',
+        file: relPath,
+        message: `BLOCKED: "${relPath}" is Rigour's own state. Change it with Rigour's commands (rigour dismiss, rigour_review_ack, rigour_remember), not by editing the file.`,
+        severity: 'critical',
+    };
+}
 // ── Protected Paths Enforcement (real-time) ───────────────────────
 /**
  * Block writes to protected paths defined in rigour.yml safety.protected_paths.

package/dist/hooks/checker.test.js

@@ -43,6 +43,14 @@ describe('runHookChecker', () => {
         const optedIn = await runHookChecker({ cwd: testDir, files: [filePath] });
         expect(optedIn.failures.some(f => f.gate === 'governance')).toBe(true);
     });
+    it("refuses an agent edit to Rigour's own state, even when rigour.yml ignores .rigour/", async () => {
+        fs.writeFileSync(path.join(testDir, 'rigour.yml'), 'version: 1\nignore:\n  - ".rigour/**"\n');
+        fs.mkdirSync(path.join(testDir, '.rigour'), { recursive: true });
+        fs.writeFileSync(path.join(testDir, '.rigour', 'dismissed.json'), '{"version":1,"entries":[]}');
+        const result = await runHookChecker({ cwd: testDir, files: ['.rigour/dismissed.json'] });
+        expect(result.status).toBe('fail');
+        expect(result.failures[0]).toMatchObject({ gate: 'file-guard', severity: 'critical' });
+    });
     it('should detect file size violations', async () => {
         const filePath = path.join(testDir, 'big.ts');
         const lines = Array.from({ length: 100 }, (_, i) => `export const v${i} = ${i};`);

package/dist/hooks/index.d.ts

@@ -16,3 +16,4 @@ export { generateDLPHookFiles } from './dlp-templates.js';
 export type { GeneratedDLPHookFile } from './dlp-templates.js';
 export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
 export type { StopDecision } from './stop-review.js';
+export { recordSessionBaseline, sessionBaseline, nextStopAttempt, clearStopAttempts } from './session-state.js';

package/dist/hooks/index.js

@@ -11,3 +11,4 @@ export { recordDLPFeedback, allowLastDLPBlock, writeDLPBlockManifest, getLearned
 export { generateDLPHookFiles } from './dlp-templates.js';
 // Stop review ("before you say done")
 export { stopReview, stopMessage, blocksStop, STOP_MAX_ATTEMPTS } from './stop-review.js';
+export { recordSessionBaseline, sessionBaseline, nextStopAttempt, clearStopAttempts } from './session-state.js';

package/dist/hooks/session-state.d.ts

@@ -0,0 +1,8 @@
+/** Record where the session started, once; later calls keep the first commit. */
+export declare function recordSessionBaseline(cwd: string, session: string): void;
+/** The commit the session started from, if it is still in history (a rebase can drop it). */
+export declare function sessionBaseline(cwd: string, session: string): string | undefined;
+/** This stop's attempt number: blocks so far plus one. */
+export declare function nextStopAttempt(cwd: string, session: string): number;
+/** The agent finished cleanly: the next stop starts counting again. The baseline stays. */
+export declare function clearStopAttempts(cwd: string, session: string): void;

package/dist/hooks/session-state.js

@@ -0,0 +1,61 @@
+/**
+ * What the agent hooks remember per session, kept outside the workspace (utils/user-state.ts)
+ * so the agent being reviewed cannot rewrite it:
+ *   - baseline: the commit HEAD was at when the session first edited a file. The stop review
+ *     covers everything since then, so committing mid-session hides nothing.
+ *   - attempts: how many times the stop review has blocked this session.
+ */
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+import { repoStateDir } from '../utils/user-state.js';
+/** Sessions untouched this long are forgotten, so the store stays small. */
+const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+function storePath(cwd) {
+    return path.join(repoStateDir(cwd), 'sessions.json');
+}
+function readStore(cwd) {
+    try {
+        return JSON.parse(fs.readFileSync(storePath(cwd), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+function update(cwd, session, change) {
+    const store = readStore(cwd);
+    const now = Date.now();
+    for (const [id, entry] of Object.entries(store))
+        if (now - entry.at > SESSION_TTL_MS)
+            delete store[id];
+    store[session] = { ...change(store[session] ?? { at: now }), at: now };
+    fs.mkdirSync(path.dirname(storePath(cwd)), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(storePath(cwd), JSON.stringify(store), { mode: 0o600 });
+    return store[session];
+}
+/** Record where the session started, once; later calls keep the first commit. */
+export function recordSessionBaseline(cwd, session) {
+    if (!session || readStore(cwd)[session]?.baseline)
+        return;
+    const head = spawnSync('git', ['rev-parse', '--verify', '--quiet', 'HEAD'], { cwd, encoding: 'utf8' });
+    if (head.status !== 0)
+        return; // no commits yet: the working-tree review already covers everything
+    update(cwd, session, entry => ({ ...entry, baseline: head.stdout.trim() }));
+}
+/** The commit the session started from, if it is still in history (a rebase can drop it). */
+export function sessionBaseline(cwd, session) {
+    const baseline = readStore(cwd)[session]?.baseline;
+    if (!baseline)
+        return undefined;
+    const known = spawnSync('git', ['cat-file', '-e', `${baseline}^{commit}`], { cwd });
+    return known.status === 0 ? baseline : undefined;
+}
+/** This stop's attempt number: blocks so far plus one. */
+export function nextStopAttempt(cwd, session) {
+    return update(cwd, session, entry => ({ ...entry, attempts: (entry.attempts ?? 0) + 1 })).attempts ?? 1;
+}
+/** The agent finished cleanly: the next stop starts counting again. The baseline stays. */
+export function clearStopAttempts(cwd, session) {
+    if (readStore(cwd)[session]?.attempts)
+        update(cwd, session, entry => ({ ...entry, attempts: 0 }));
+}

package/dist/hooks/stop-review.d.ts

@@ -1,7 +1,8 @@
 /**
- * The "before you say done" review: when an agent is about to stop, review the
- * uncommitted change and, if it introduced serious findings, tell the agent
- * what to fix instead of letting it finish.
+ * The "before you say done" review: when an agent is about to stop, review what
+ * the session changed (since its baseline commit, or the uncommitted change when
+ * none was recorded) and, if it introduced serious findings, tell the agent what
+ * to fix instead of letting it finish.
  *
  * Only findings that deserve it block: critical ones, and high ones that are
  * proven (the semantic engine traced them) or security findings. A high
@@ -20,7 +21,8 @@ export interface StopDecision {
     findings: Failure[];
     reviewedFiles: string[];
 }
-export declare function stopReview(cwd: string, config: Config, attempt: number): Promise<StopDecision>;
+/** `since`: the session's baseline commit (session-state.ts); committing after it hides nothing. */
+export declare function stopReview(cwd: string, config: Config, attempt: number, since?: string): Promise<StopDecision>;
 export declare function reviewAckMessage(items: ReviewTaskItem[], attempt: number): string;
 /** Critical, or high and either proven by the semantic engine or a security finding. */
 export declare function blocksStop(finding: Failure): boolean;

package/dist/hooks/stop-review.js

@@ -3,9 +3,11 @@ import { buildReviewTask } from '../review/review-task.js';
 import { diffFromGit } from '../review/git-diff.js';
 export const STOP_MAX_ATTEMPTS = 3;
 const MAX_LISTED = 8;
-export async function stopReview(cwd, config, attempt) {
-    const diff = diffFromGit(cwd, { mode: 'working' });
-    const result = await reviewChange({ cwd, config, diff });
+/** `since`: the session's baseline commit (session-state.ts); committing after it hides nothing. */
+export async function stopReview(cwd, config, attempt, since) {
+    const source = since ? { mode: 'since', commit: since } : { mode: 'working' };
+    const diff = diffFromGit(cwd, source);
+    const result = await reviewChange({ cwd, config, diff, source });
     const blocking = result.findings.filter(blocksStop);
     const unreviewed = config.hooks?.require_review_ack ? buildReviewTask(cwd, diff, config.gates.deep?.router).items : [];
     const reviewed = { findings: result.findings, reviewedFiles: Object.keys(result.changedLines) };

package/dist/hooks/templates.js

@@ -47,7 +47,7 @@ function generateClaudeHooks(checkerCommand) {
                     hooks: [
                         {
                             type: "command",
-                            command: `${checkerCommand} --files "$TOOL_INPUT_file_path"`,
+                            command: `${checkerCommand} --stdin`,
                         }
                     ]
                 }

package/dist/index.d.ts

@@ -11,8 +11,10 @@ export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js'
 export * from './utils/logger.js';
 export { normalizeScopePatterns, isScoped } from './utils/scope.js';
 export { deepAnalysisError } from './utils/deep-status.js';
+export { rigourUserDir, repoStateDir } from './utils/user-state.js';
 export { reviewChange, toReviewFinding, type ReviewInput, type ReviewResult, type ReviewFinding } from './review/review.js';
 export { splitByChangedLines, type ChangedLineSplit } from './review/changed-lines.js';
+export { isControlFile, mergeBaseOf, readStateFile } from './review/trusted-state.js';
 export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMISSED_FILE } from './review/quiet.js';
 export { isGeneratedFile } from './review/generated-files.js';
 export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';

package/dist/index.js

@@ -11,8 +11,10 @@ export { FrontendSecretExposureGate } from './gates/frontend-secret-exposure.js'
 export * from './utils/logger.js';
 export { normalizeScopePatterns, isScoped } from './utils/scope.js';
 export { deepAnalysisError } from './utils/deep-status.js';
+export { rigourUserDir, repoStateDir } from './utils/user-state.js';
 export { reviewChange, toReviewFinding } from './review/review.js';
 export { splitByChangedLines } from './review/changed-lines.js';
+export { isControlFile, mergeBaseOf, readStateFile } from './review/trusted-state.js';
 export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMISSED_FILE } from './review/quiet.js';
 export { isGeneratedFile } from './review/generated-files.js';
 export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';

package/dist/review/check-outcomes.d.ts

@@ -19,7 +19,8 @@ export declare function checkId(finding: {
 }): string;
 export declare function precisionOf(outcome: CheckOutcome): number;
 export declare function isMuted(outcome: CheckOutcome | undefined): boolean;
-export declare function readOutcomes(cwd: string): Record<string, CheckOutcome>;
+/** Outcomes in the working tree, or at `ref` for an independent review (trusted-state.ts). */
+export declare function readOutcomes(cwd: string, ref?: string): Record<string, CheckOutcome>;
 export declare function recordOutcome(cwd: string, check: string, kind: keyof CheckOutcome): void;
 /** Every check with an outcome, most dismissed first. */
 export declare function checkPrecisions(cwd: string): CheckPrecision[];

package/dist/review/check-outcomes.js

@@ -13,6 +13,7 @@
  */
 import fs from 'fs';
 import path from 'path';
+import { readStateFile } from './trusted-state.js';
 const OUTCOMES_FILE = path.join('.rigour', 'check-outcomes.json');
 const REPORTED_FILE = path.join('.rigour', 'reported-findings.json');
 const MAX_REPORTED = 2000;
@@ -32,8 +33,16 @@ export function isMuted(outcome) {
         return false;
     return outcome.fixed + outcome.dismissed >= MUTE_MIN_OUTCOMES && precisionOf(outcome) < MUTE_BELOW;
 }
-export function readOutcomes(cwd) {
-    return readJson(path.join(cwd, OUTCOMES_FILE)) ?? {};
+/** Outcomes in the working tree, or at `ref` for an independent review (trusted-state.ts). */
+export function readOutcomes(cwd, ref) {
+    if (!ref)
+        return readJson(path.join(cwd, OUTCOMES_FILE)) ?? {};
+    try {
+        return JSON.parse(readStateFile(cwd, OUTCOMES_FILE, ref) ?? '{}');
+    }
+    catch {
+        return {};
+    }
 }
 export function recordOutcome(cwd, check, kind) {
     const outcomes = readOutcomes(cwd);

package/dist/review/git-diff.d.ts

@@ -3,6 +3,9 @@ export type DiffSource = {
 } | {
     mode: 'base';
     base: string;
+} | {
+    mode: 'since';
+    commit: string;
 };
 export declare class GitDiffError extends Error {
 }

package/dist/review/git-diff.js

@@ -5,6 +5,8 @@
  *   git does not track yet (what an agent has just written).
  * - base: everything on this branch since it left `base` (the merge-base),
  *   including uncommitted changes (what a pull request contains).
+ * - since: everything after `commit`, committed or not, plus untracked files
+ *   (what an agent session wrote, even if it committed along the way).
  */
 import { spawnSync } from 'child_process';
 export class GitDiffError extends Error {
@@ -14,6 +16,9 @@ export function diffFromGit(cwd, source = { mode: 'working' }) {
         const mergeBase = git(cwd, ['merge-base', source.base, 'HEAD']).trim();
         return git(cwd, ['diff', '--no-color', '--no-ext-diff', mergeBase]);
     }
+    if (source.mode === 'since') {
+        return git(cwd, ['diff', '--no-color', '--no-ext-diff', source.commit]) + untrackedFiles(cwd).map(file => newFileDiff(cwd, file)).join('');
+    }
     const tracked = hasHead(cwd) ? git(cwd, ['diff', '--no-color', '--no-ext-diff', 'HEAD']) : '';
     return tracked + untrackedFiles(cwd).map(file => newFileDiff(cwd, file)).join('');
 }

package/dist/review/migration-order.js

@@ -18,7 +18,7 @@ export function migrationOrderFailures(cwd, diff, source, config) {
     const settings = config.gates.migration_order;
     if (!settings?.enabled)
         return [];
-    const base = source?.mode === 'base' ? source.base : 'HEAD';
+    const base = source?.mode === 'base' ? source.base : source?.mode === 'since' ? source.commit : 'HEAD';
     const byDirectory = new Map();
     for (const file of addedFiles(diff)) {
         const directory = path.posix.dirname(file);

package/dist/review/quiet.d.ts

@@ -12,7 +12,8 @@ export interface QuietSplit {
     /** Which gates the dismissed findings came from: where Rigour is wrong for this team. */
     dismissedByGate: Record<string, number>;
 }
-export declare function quietSplit(cwd: string, findings: Failure[], includeHeuristics?: boolean): QuietSplit;
-export declare function dismissedKeys(cwd: string): Set<string>;
+/** `trustedRef`: read dismissals and outcomes as of that commit, not as the change left them. */
+export declare function quietSplit(cwd: string, findings: Failure[], includeHeuristics?: boolean, trustedRef?: string): QuietSplit;
+export declare function dismissedKeys(cwd: string, ref?: string): Set<string>;
 /** Record "not a bug" for a finding key; idempotent. */
 export declare function dismissFinding(cwd: string, key: string, reason: string, at?: string): boolean;

package/dist/review/quiet.js

@@ -11,12 +11,15 @@
  * blocking. A team that wants them back sets review.include_heuristics.
  *
  * A finding a person judged "not a bug" is dismissed by its key and never
- * reported again (.rigour/dismissed.json, meant to be committed).
+ * reported again (.rigour/dismissed.json, meant to be committed). An
+ * independent review reads it from the base (trusted-state.ts), so a change
+ * cannot dismiss its own findings.
  */
 import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import { checkId, isMuted, readOutcomes, recordOutcome, reportedCheck } from './check-outcomes.js';
+import { readStateFile } from './trusted-state.js';
 const PROVEN_GATES = new Set(['semantic-bugs', 'hallucinated-imports', 'security-patterns', 'deep-analysis', 'diff-tests']);
 export const DISMISSED_FILE = path.join('.rigour', 'dismissed.json');
 export function isProven(failure) {
@@ -26,9 +29,10 @@ export function isProven(failure) {
 export function findingKey(failure) {
     return crypto.createHash('sha256').update(`${failure.id}\u0000${failure.files?.[0] ?? ''}\u0000${failure.details}`).digest('hex').slice(0, 16);
 }
-export function quietSplit(cwd, findings, includeHeuristics = false) {
-    const dismissed = dismissedKeys(cwd);
-    const outcomes = readOutcomes(cwd);
+/** `trustedRef`: read dismissals and outcomes as of that commit, not as the change left them. */
+export function quietSplit(cwd, findings, includeHeuristics = false, trustedRef) {
+    const dismissed = dismissedKeys(cwd, trustedRef);
+    const outcomes = readOutcomes(cwd, trustedRef);
     const split = { speaking: [], advisory: [], muted: 0, dismissed: 0, dismissedByGate: {} };
     for (const finding of findings) {
         if (dismissed.has(findingKey(finding))) {
@@ -44,9 +48,9 @@ export function quietSplit(cwd, findings, includeHeuristics = false) {
     }
     return split;
 }
-export function dismissedKeys(cwd) {
+export function dismissedKeys(cwd, ref) {
     try {
-        const parsed = JSON.parse(fs.readFileSync(path.join(cwd, DISMISSED_FILE), 'utf8'));
+        const parsed = JSON.parse(readStateFile(cwd, DISMISSED_FILE, ref) ?? '');
         return new Set(Array.isArray(parsed?.entries) ? parsed.entries.map((e) => e?.key).filter((k) => typeof k === 'string') : []);
     }
     catch {

package/dist/review/review.d.ts

@@ -12,6 +12,8 @@ export interface ReviewInput {
     diffTests?: boolean;
     /** Deep analysis; `focusLines` and `removedLines` are filled from the diff. */
     deep?: Omit<DeepOptions, 'focusLines' | 'removedLines' | 'diff'>;
+    /** Read dismissals and check outcomes at this commit (the base), not as the change left them. */
+    trustedRef?: string;
 }
 export interface ReviewResult {
     status: 'PASS' | 'FAIL' | 'ERROR';
@@ -33,6 +35,8 @@ export interface ReviewResult {
     deepError?: string;
     /** Gates that crashed instead of running; a proven one makes the result ERROR. */
     gateErrors: string[];
+    /** rigour.yml or .rigour/ files this change edits: they steer the review, so they are called out. */
+    controlFilesChanged: string[];
 }
 export interface ReviewFinding {
     id: string;

package/dist/review/review.js

@@ -19,12 +19,13 @@ import { checkId, rememberReported } from './check-outcomes.js';
 import { diffFromGit } from './git-diff.js';
 import { diffTestFailures } from './diff-test-findings.js';
 import { migrationOrderFailures } from './migration-order.js';
+import { isControlFile } from './trusted-state.js';
 export async function reviewChange(input) {
     const diff = input.diff ?? diffFromGit(input.cwd, input.source);
     const changedLines = withoutGenerated(input.cwd, parseDiff(diff));
     const targets = input.files?.length ? input.files : Object.keys(changedLines);
     if (targets.length === 0) {
-        return { status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], muted: 0, dismissed: 0, dismissedByGate: {}, unlocated: 0, excludedOutsideChangedLines: 0, changedLines, report: null, gateErrors: [] };
+        return { status: 'PASS', findings: [], fileFindings: [], contextFindings: [], advisory: [], muted: 0, dismissed: 0, dismissedByGate: {}, unlocated: 0, excludedOutsideChangedLines: 0, changedLines, report: null, gateErrors: [], controlFilesChanged: controlFiles(diff) };
     }
     const deep = input.deep ? { ...input.deep, focusLines: changedLinesByFile(changedLines), removedLines: removedByFile(diff), diff } : undefined;
     const report = await new GateRunner(input.config).run(input.cwd, await normalizeScopePatterns(input.cwd, targets), deep);
@@ -33,7 +34,7 @@ export async function reviewChange(input) {
     report.failures.push(...migrationOrderFailures(input.cwd, diff, input.source, input.config));
     const split = splitByChangedLines(report.failures, changedLines, deep ? changedFunctionSpans(input.cwd, changedLines) : {}, removedByFile(diff));
     const deepError = deepAnalysisError(report);
-    const quiet = quietSplit(input.cwd, split.findings, input.config.review?.include_heuristics);
+    const quiet = quietSplit(input.cwd, split.findings, input.config.review?.include_heuristics, input.trustedRef);
     rememberReported(input.cwd, [...quiet.speaking, ...quiet.advisory].map(f => ({ key: findingKey(f), check: checkId(f) })));
     const gateErrors = crashedGates(report);
     const provenCrashed = gateErrors.some(id => isProven({ id }));
@@ -51,9 +52,20 @@ export async function reviewChange(input) {
         changedLines,
         report,
         gateErrors,
+        controlFilesChanged: controlFiles(diff),
         ...(deepError ? { deepError } : {}),
     };
 }
+/** Every path the diff touches (including deletions, which parseDiff drops) that steers Rigour itself. */
+function controlFiles(diff) {
+    const files = new Set();
+    for (const match of diff.matchAll(/^diff --git a\/(\S+) b\/(\S+)$/gm)) {
+        for (const file of [match[1], match[2]])
+            if (isControlFile(file))
+                files.add(file);
+    }
+    return [...files].sort();
+}
 function crashedGates(report) {
     return Object.entries(report.summary).filter(([, status]) => status === 'ERROR').map(([id]) => id);
 }

package/dist/review/review.test.js

@@ -10,6 +10,7 @@ import { splitByChangedLines } from './changed-lines.js';
 import { anchorInChangedFunction, changedFunctionSpans } from './changed-function-spans.js';
 import { diffFromGit } from './git-diff.js';
 import { reviewChange, toReviewFinding } from './review.js';
+import { findingKey } from './quiet.js';
 const LEAKY = [
     'export async function notify(endpoint: string, signature: string) {',
     "  return fetch(endpoint, { method: 'POST', headers: { 'x-hook-signature': signature } });",
@@ -114,6 +115,24 @@ describe('git-backed review', () => {
         expect(semantic.map(f => [f.files?.[0], f.line])).toEqual([['src/notify.ts', 2]]);
         expect(toReviewFinding(semantic[0])).toMatchObject({ id: 'semantic-bugs', file: 'src/notify.ts', line: 2, severity: 'high' });
     });
+    it('lets a change dismiss its own finding only when the review trusts the working tree', async () => {
+        write('src/old.ts', 'export const a = 1;\n');
+        write('.gitignore', '.rigour/*\n!.rigour/dismissed.json\n');
+        git('add', '-A');
+        git('commit', '-qm', 'init');
+        git('checkout', '-q', '-b', 'pr');
+        write('src/notify.ts', LEAKY);
+        const config = ConfigSchema.parse({ version: 1, gates: { semantic_bugs: { enabled: true } } });
+        const key = findingKey((await reviewChange({ cwd: repo, config })).findings[0]);
+        write('.rigour/dismissed.json', JSON.stringify({ version: 1, entries: [{ key, reason: 'trust me', at: 'now' }] }));
+        git('add', '-A');
+        git('commit', '-qm', 'pr');
+        const trusting = await reviewChange({ cwd: repo, config, source: { mode: 'base', base: 'main' } });
+        expect([trusting.status, trusting.dismissed]).toEqual(['PASS', 1]);
+        expect(trusting.controlFilesChanged).toEqual(['.rigour/dismissed.json']);
+        const independent = await reviewChange({ cwd: repo, config, source: { mode: 'base', base: 'main' }, trustedRef: 'main' });
+        expect([independent.status, independent.dismissed]).toEqual(['FAIL', 0]);
+    });
     it('runs every gate in a git worktree, where .git is a file', async () => {
         write('src/a.ts', 'export const a = 1;\n');
         git('add', '-A');

package/dist/review/trusted-state.d.ts

@@ -0,0 +1,6 @@
+/** Paths that steer Rigour itself; a change touching them is called out in the review. */
+export declare function isControlFile(file: string): boolean;
+/** A repository file's content at `ref`, or in the working tree when no ref is given; null when absent. */
+export declare function readStateFile(cwd: string, rel: string, ref?: string): string | null;
+/** The commit a branch left `base` at: the state a pull request is judged against. */
+export declare function mergeBaseOf(cwd: string, base: string): string;

package/dist/review/trusted-state.js

@@ -0,0 +1,35 @@
+/**
+ * Which copy of Rigour's own settings a review trusts.
+ *
+ * Dismissals, check outcomes and rigour.yml decide what a review reports. In the working tree they
+ * are whatever the change under review wrote, so a pull request could dismiss its own critical
+ * finding. An independent review reads them from the base instead (`ref`): a dismissal or setting
+ * added by the change takes effect once it is merged, the same rule CODEOWNERS follows.
+ */
+import { spawnSync } from 'child_process';
+import fs from 'fs';
+import path from 'path';
+/** Paths that steer Rigour itself; a change touching them is called out in the review. */
+export function isControlFile(file) {
+    return file === 'rigour.yml' || file.startsWith('.rigour/');
+}
+/** A repository file's content at `ref`, or in the working tree when no ref is given; null when absent. */
+export function readStateFile(cwd, rel, ref) {
+    if (!ref) {
+        try {
+            return fs.readFileSync(path.join(cwd, rel), 'utf8');
+        }
+        catch {
+            return null;
+        }
+    }
+    const result = spawnSync('git', ['show', `${ref}:${rel.split(path.sep).join('/')}`], { cwd, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+    return result.status === 0 ? result.stdout : null;
+}
+/** The commit a branch left `base` at: the state a pull request is judged against. */
+export function mergeBaseOf(cwd, base) {
+    const result = spawnSync('git', ['merge-base', base, 'HEAD'], { cwd, encoding: 'utf8' });
+    if (result.status !== 0)
+        throw new Error(`git merge-base ${base} HEAD failed: ${result.stderr.trim()}`);
+    return result.stdout.trim();
+}

package/dist/types/index.d.ts

@@ -3643,6 +3643,11 @@ export interface DeepOptions {
     }>>;
     /** What the change intends (a PR description): reference for the stronger tiers. */
     prBody?: string;
+    /**
+     * Review every risky changed function, ignoring the review ledger and reviewed.json. Those
+     * record what an agent said it reviewed; an enforcing check reviews independently.
+     */
+    independent?: boolean;
     /** The change's unified diff (from reviewChange): a cloud agentic review reads the PR as a whole. */
     diff?: string;
 }

package/dist/utils/user-state.d.ts

@@ -0,0 +1,7 @@
+/** The user's Rigour directory: RIGOUR_HOME/.rigour when set (tests, sandboxes), else ~/.rigour. */
+export declare function rigourUserDir(): string;
+/**
+ * Per-repository state kept outside the workspace, where an agent editing the repository
+ * cannot rewrite it: arbitration tokens, stop-hook attempt counts. Keyed by the real path.
+ */
+export declare function repoStateDir(cwd: string): string;

package/dist/utils/user-state.js

@@ -0,0 +1,21 @@
+import crypto from 'crypto';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+/** The user's Rigour directory: RIGOUR_HOME/.rigour when set (tests, sandboxes), else ~/.rigour. */
+export function rigourUserDir() {
+    return path.join(process.env.RIGOUR_HOME || os.homedir(), '.rigour');
+}
+/**
+ * Per-repository state kept outside the workspace, where an agent editing the repository
+ * cannot rewrite it: arbitration tokens, stop-hook attempt counts. Keyed by the real path.
+ */
+export function repoStateDir(cwd) {
+    let root = path.resolve(cwd);
+    try {
+        root = fs.realpathSync(root);
+    }
+    catch { /* not created yet: the resolved path is the key */ }
+    const key = crypto.createHash('sha256').update(root).digest('hex').slice(0, 16);
+    return path.join(rigourUserDir(), 'repos', key);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.5.3",
+  "version": "6.5.4",
   "description": "Rigour's review engine: deterministic gates on changed lines, rules and lessons learned from your team's fixes, and per-check precision from what you fix versus dismiss, across TypeScript, JavaScript, Python, Go, Ruby and C#.",
   "engines": {
     "node": ">=22"
@@ -70,11 +70,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.5.3",
-    "@rigour-labs/brain-darwin-x64": "6.5.3",
-    "@rigour-labs/brain-linux-x64": "6.5.3",
-    "@rigour-labs/brain-linux-arm64": "6.5.3",
-    "@rigour-labs/brain-win-x64": "6.5.3"
+    "@rigour-labs/brain-darwin-arm64": "6.5.4",
+    "@rigour-labs/brain-darwin-x64": "6.5.4",
+    "@rigour-labs/brain-linux-arm64": "6.5.4",
+    "@rigour-labs/brain-linux-x64": "6.5.4",
+    "@rigour-labs/brain-win-x64": "6.5.4"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",