@rigour-labs/core 6.6.0 → 6.6.2

package/dist/deep/risk.d.ts

@@ -1,4 +1,5 @@
 import type { RemovedBlock } from '../utils/diff.js';
+import { type ReviewLesson } from '../review-learning/lessons.js';
 /** Kinds of operation where a wrong line costs the most; matched on the function's text. */
 export declare const SENSITIVE: ReadonlyArray<{
     kind: string;
@@ -14,6 +15,8 @@ export interface RiskSignals {
     removedGuard: boolean;
     /** SENSITIVE kinds this function touches. */
     sensitive: string[];
+    /** A verified team lesson about this file that names code this function uses. */
+    lesson?: string;
 }
 export interface FunctionRisk {
     file: string;
@@ -22,7 +25,7 @@ export interface FunctionRisk {
     end: number;
     signals: RiskSignals;
     score: number;
-    /** sha256 of the function's text with whitespace collapsed: any edit to it changes this. */
+    /** sha256 of the function's exact text (line endings normalised): any edit to it changes this. */
     hash: string;
 }
 /**
@@ -30,8 +33,8 @@ export interface FunctionRisk {
  * "rules only". The router reviews functions at or above `min_score`.
  */
 export declare function scoreRisk(signals: RiskSignals): number;
-/** Changed functions across the change, riskiest first. */
-export declare function rankChangedFunctions(cwd: string, focusLines: Record<string, number[]>, removed?: Record<string, RemovedBlock[]>): FunctionRisk[];
+/** Changed functions outside tests, riskiest first; `lessons` are the team's verified review lessons in play. */
+export declare function rankChangedFunctions(cwd: string, focusLines: Record<string, number[]>, removed?: Record<string, RemovedBlock[]>, lessons?: ReviewLesson[]): FunctionRisk[];
 /** The current text hash and span of a named function in a file, if the file parses and has it. */
 export declare function findFunction(cwd: string, file: string, name: string): {
     hash: string;

package/dist/deep/risk.js

@@ -12,7 +12,10 @@ import fs from 'fs';
 import path from 'path';
 import ts from 'typescript';
 import { changedFunctions, isExported } from './changed-functions.js';
+import { isSpecific } from '../review-learning/lessons.js';
 const PARSEABLE = /\.(?:[cm]?[jt]sx?)$/i;
+/** Tests are reviewed with the change, not routed: their fixtures read as data writes and money, and their callbacks have no callers. */
+const TEST_FILE = /\.(?:test|spec)\.[cm]?[jt]sx?$|(?:^|\/)__tests__\//i;
 /** Kinds of operation where a wrong line costs the most; matched on the function's text. */
 export const SENSITIVE = [
     { kind: 'data-write', pattern: /\.(?:insert|update|upsert|delete|rpc)\s*\(|\b(?:INSERT|UPDATE|DELETE)\s+(?:INTO\s+)?\w|\bON CONFLICT\b/ },
@@ -28,7 +31,9 @@ export const SENSITIVE = [
  */
 export function scoreRisk(signals) {
     // Strong signals clear the default bar (1) on their own; shape alone (size, nesting) never does.
+    // A mistake this team already fixed once is as strong a signal as a removed guard.
     let score = signals.removedGuard ? 2 : 0;
+    score += signals.lesson ? 2 : 0;
     score += signals.sensitive.includes('data-write') ? 2 : 0;
     // Other sensitive kinds add, capped so a function that mentions everything does not drown the rest.
     score += Math.min(2, signals.sensitive.filter(kind => kind !== 'data-write').length);
@@ -37,11 +42,11 @@ export function scoreRisk(signals) {
     score += signals.exported && signals.async ? 0.5 : 0;
     return score;
 }
-/** Changed functions across the change, riskiest first. */
-export function rankChangedFunctions(cwd, focusLines, removed = {}) {
+/** Changed functions outside tests, riskiest first; `lessons` are the team's verified review lessons in play. */
+export function rankChangedFunctions(cwd, focusLines, removed = {}, lessons = []) {
     const ranked = [];
     for (const [file, lines] of Object.entries(focusLines)) {
-        if (!PARSEABLE.test(file) || lines.length === 0)
+        if (!PARSEABLE.test(file) || TEST_FILE.test(file) || lines.length === 0)
             continue;
         let text;
         try {
@@ -57,6 +62,9 @@ export function rankChangedFunctions(cwd, focusLines, removed = {}) {
             const end = sourceFile.getLineAndCharacterOfPosition(fn.getEnd()).line + 1;
             const added = lines.filter(l => l >= start && l <= end).map(l => textLines[l - 1] ?? '');
             const signals = signalsOf(fn, sourceFile, start, end, removed[file] ?? [], added);
+            const lesson = lessonFor(file, fn.getText(sourceFile), lessons);
+            if (lesson)
+                signals.lesson = lesson;
             ranked.push({ file, name: nameOf(fn, sourceFile), start, end, signals, score: scoreRisk(signals), hash: functionHash(fn.getText(sourceFile)) });
         }
     }
@@ -101,6 +109,14 @@ export function findFunction(cwd, file, name) {
 export function functionHash(text) {
     return crypto.createHash('sha256').update(text.replace(/\r\n/g, '\n')).digest('hex');
 }
+/** The first lesson about this file that names an identifier the function uses (only specific names link code). */
+function lessonFor(file, body, lessons) {
+    const forFile = lessons.filter(l => l.file === file);
+    if (forFile.length === 0)
+        return undefined;
+    const used = new Set(body.match(/[A-Za-z_$][\w$]*/g) ?? []);
+    return forFile.find(l => l.symbols.some(s => isSpecific(s) && used.has(s)))?.text;
+}
 const GUARD = /\b(?:if|else|return|throw|break|continue|catch)\b|\?\?|\?\./g;
 function guards(lines) {
     return lines.reduce((count, line) => count + (line.match(GUARD)?.length ?? 0), 0);

package/dist/deep/risk.test.js

@@ -3,7 +3,7 @@ import os from 'os';
 import path from 'path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { functionHash, rankChangedFunctions, scoreRisk } from './risk.js';
-import { routeFiles } from './router.js';
+import { DEFAULT_MIN_SCORE, routeFiles } from './router.js';
 let dir;
 beforeEach(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'risk-')); });
 afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
@@ -32,6 +32,33 @@ describe('rankChangedFunctions', () => {
         expect([byName.label.start, byName.label.end]).toEqual([8, 10]);
     });
 });
+describe('test files', () => {
+    it('are never routed, however their fixtures read', () => {
+        fs.mkdirSync(path.join(dir, '__tests__'));
+        for (const file of ['sync.test.ts', 'sync.spec.js', '__tests__/sync.ts'])
+            fs.writeFileSync(path.join(dir, file), SYNC);
+        expect(rankChangedFunctions(dir, { 'sync.test.ts': [4], 'sync.spec.js': [4], '__tests__/sync.ts': [4] })).toEqual([]);
+    });
+});
+describe('team lessons as a risk signal', () => {
+    const lesson = (over) => ({
+        id: 'l1', text: 'Trim before comparing names.', file: 'sync.ts', symbols: ['trimStart'], state: 'verified',
+        evidence: [{ pr: 1, comment: 'c', author: 'r' }], createdAt: '', updatedAt: '', ...over,
+    });
+    const LABEL = 'function label(name) {\n  return name.trimStart();\n}\n';
+    it('makes a plain function risky when a lesson for its file names a symbol it uses', () => {
+        fs.writeFileSync(path.join(dir, 'sync.ts'), LABEL);
+        const [f] = rankChangedFunctions(dir, { 'sync.ts': [2] }, {}, [lesson({})]);
+        expect(f.signals.lesson).toBe('Trim before comparing names.');
+        expect(f.score).toBeGreaterThanOrEqual(DEFAULT_MIN_SCORE);
+    });
+    it('ignores lessons for other files and lessons naming only common words', () => {
+        fs.writeFileSync(path.join(dir, 'sync.ts'), LABEL);
+        const other = rankChangedFunctions(dir, { 'sync.ts': [2] }, {}, [lesson({ file: 'other.ts' }), lesson({ symbols: ['name'] })]);
+        expect(other[0].signals.lesson).toBeUndefined();
+        expect(other[0].score).toBe(0);
+    });
+});
 describe('scoreRisk', () => {
     it('ranks a data write behind a removed guard above a plain helper', () => {
         const risky = { exported: true, async: true, nesting: 2, lines: 30, removedGuard: true, sensitive: ['data-write', 'paging'] };

package/dist/deep/router.d.ts

@@ -7,6 +7,7 @@
  */
 import type { RemovedBlock } from '../utils/diff.js';
 import { type ReviewedKey } from '../review/ledger.js';
+import type { ReviewLesson } from '../review-learning/lessons.js';
 export interface RouterPolicy {
     enabled?: boolean;
     min_score?: number;
@@ -21,7 +22,7 @@ export interface RouterStats {
 }
 export declare const DEFAULT_MIN_SCORE = 1;
 export declare const DEFAULT_MAX_FUNCTIONS = 12;
-export declare function routeFiles(cwd: string, files: string[], focusLines: Record<string, number[]>, removed?: Record<string, RemovedBlock[]>, policy?: RouterPolicy, reviewed?: ReviewedKey[]): {
+export declare function routeFiles(cwd: string, files: string[], focusLines: Record<string, number[]>, removed?: Record<string, RemovedBlock[]>, policy?: RouterPolicy, reviewed?: ReviewedKey[], lessons?: ReviewLesson[]): {
     files: Set<string>;
     stats: RouterStats;
 };

package/dist/deep/router.js

@@ -2,9 +2,9 @@ import { rankChangedFunctions } from './risk.js';
 import { isReviewed } from '../review/ledger.js';
 export const DEFAULT_MIN_SCORE = 1;
 export const DEFAULT_MAX_FUNCTIONS = 12;
-export function routeFiles(cwd, files, focusLines, removed = {}, policy = {}, reviewed = []) {
+export function routeFiles(cwd, files, focusLines, removed = {}, policy = {}, reviewed = [], lessons = []) {
     const inScope = Object.fromEntries(files.filter(f => focusLines[f]?.length).map(f => [f, focusLines[f]]));
-    const ranked = rankChangedFunctions(cwd, inScope, removed);
+    const ranked = rankChangedFunctions(cwd, inScope, removed, lessons);
     const minScore = policy.min_score ?? DEFAULT_MIN_SCORE;
     const risky = ranked.filter(f => f.score >= minScore);
     const unreviewed = risky.filter(f => !isReviewed(reviewed, { file: f.file, function: f.name, hash: f.hash }));

package/dist/gates/deep-analysis.js

@@ -23,7 +23,7 @@ import { buildReviewTask } from '../review/review-task.js';
 import { reviewPullRequest } from '../deep/pr-review.js';
 import { relatedChanges } from '../deep/related-changes.js';
 import { rankChangedFunctions } from '../deep/risk.js';
-import { lessonsForDiff, lessonsSection } from '../review-learning/team-lessons.js';
+import { activeLessons, lessonsForDiff, lessonsSection } from '../review-learning/team-lessons.js';
 import { rulesForDiff, rulesSection } from '../review-learning/repo-rules.js';
 import { verifyCodeFindings } from '../deep/code-verifier.js';
 import { runIntentChecks } from './deep-intent.js';
@@ -153,7 +153,7 @@ export class DeepAnalysisGate extends Gate {
             this.config.onProgress?.('  Router: no risky change for the model; the gates cover this PR.');
             return [];
         }
-        const focus = buildReviewTask(cwd, options.diff, this.config.router).items;
+        const focus = buildReviewTask(cwd, options.diff, this.config.router, this.config.reviewLessons, false, trustedReviews(cwd, options)).items;
         const changedFiles = Object.keys(options.focusLines ?? {});
         const related = relatedChanges(cwd, changedFiles, rankChangedFunctions(cwd, options.focusLines ?? {}, options.removedLines));
         this.config.onProgress?.(`  Reviewing the PR as a whole (${focus.length} risky function(s) first)...`);
@@ -179,7 +179,7 @@ export class DeepAnalysisGate extends Gate {
         const { options } = this.config;
         if (!isCloud(options) || this.config.router?.enabled === false || !options.focusLines)
             return facts;
-        const routed = routeFiles(cwd, facts.map(f => f.path), options.focusLines, options.removedLines, this.config.router, trustedReviews(cwd, options));
+        const routed = routeFiles(cwd, facts.map(f => f.path), options.focusLines, options.removedLines, this.config.router, trustedReviews(cwd, options), activeLessons(cwd, this.config.reviewLessons));
         this.outcome.router = routed.stats;
         if (routed.stats.files_skipped > 0) {
             this.config.onProgress?.(`  Router: ${routed.stats.routed} of ${routed.stats.functions} changed function(s) to the model; ${routed.stats.files_skipped} file(s) left to the gates.`);

package/dist/index.d.ts

@@ -19,6 +19,7 @@ export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMIS
 export { isGeneratedFile } from './review/generated-files.js';
 export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
 export { buildReviewTask, type ReviewTask, type ReviewTaskItem } from './review/review-task.js';
+export { buildQualityReceipt, receiptReport, type QualityReceipt, type ReceiptGap, type ReceiptOptions } from './review/receipt.js';
 export { acknowledgeReview, type ReviewAck, type AckResult } from './review/review-ack.js';
 export { exportReviewed, readLedger, reviewedKeys, isReviewed, recordReview, REVIEWED_FILE, type LedgerEntry, type ReviewedKey, type ReviewVerdict } from './review/ledger.js';
 export { rankChangedFunctions, scoreRisk, functionHash, findFunction, type FunctionRisk, type RiskSignals } from './deep/risk.js';

package/dist/index.js

@@ -19,6 +19,7 @@ export { dismissFinding, dismissedKeys, findingKey, isProven, quietSplit, DISMIS
 export { isGeneratedFile } from './review/generated-files.js';
 export { countUsage, durationBucket, flushDailyUsage, isTelemetryEnabled, readTelemetryState, setTelemetryEnabled, shouldAskTelemetry, telemetryToken, trackUsage } from './telemetry/telemetry.js';
 export { buildReviewTask } from './review/review-task.js';
+export { buildQualityReceipt, receiptReport } from './review/receipt.js';
 export { acknowledgeReview } from './review/review-ack.js';
 export { exportReviewed, readLedger, reviewedKeys, isReviewed, recordReview, REVIEWED_FILE } from './review/ledger.js';
 export { rankChangedFunctions, scoreRisk, functionHash, findFunction } from './deep/risk.js';

package/dist/review/receipt.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The quality receipt for a change: for every changed function outside tests, what is known about
+ * it before a model looks at anything.
+ *
+ * - reviewed: risky, and reviewed at its current code during development (the ledger or a
+ *   committed reviewed.json, keyed by the function's exact source);
+ * - changed since review: risky, reviewed once, then edited, so that review no longer counts;
+ * - low risk: below the router's bar, left to the deterministic checks;
+ * - not covered: risky with no review of this code. These are what a PR review should spend on.
+ *
+ * Reviews are agents' and people's own records. An independent (enforcing) review does not count
+ * them, and the receipt says how many it set aside rather than hiding them.
+ */
+import { type RouterPolicy } from '../deep/router.js';
+import { type LessonMode } from '../review-learning/team-lessons.js';
+export interface ReceiptGap {
+    file: string;
+    function: string;
+    start: number;
+    score: number;
+    /** Reviewed once, then edited. */
+    changedSinceReview: boolean;
+    /** The team lesson that made it risky, when one did. */
+    lesson?: string;
+}
+export interface QualityReceipt {
+    functions: number;
+    reviewed: number;
+    changedSinceReview: number;
+    lowRisk: number;
+    notCovered: ReceiptGap[];
+    /** Who reviewed the functions counted as reviewed: agent, human, or byok:<model>. */
+    reviewers: Record<string, number>;
+    /** Changed files Rigour cannot split into functions (other languages, config): rules only. */
+    otherFiles: number;
+    /** Self-reported reviews an independent review did not count. */
+    setAside: number;
+}
+export interface ReceiptOptions {
+    policy?: RouterPolicy;
+    lessonMode?: LessonMode;
+    /** Trust nothing the change itself recorded (enforce mode). */
+    independent?: boolean;
+}
+export declare function buildQualityReceipt(cwd: string, diff: string, options?: ReceiptOptions): QualityReceipt;
+/** The receipt as reports carry it (snake_case, like the rest of `rigour review --json` and the MCP tool). */
+export declare function receiptReport(r: QualityReceipt): {
+    functions: number;
+    reviewed: number;
+    changed_since_review: number;
+    low_risk: number;
+    not_covered: {
+        lesson?: string | undefined;
+        file: string;
+        function: string;
+        line: number;
+        score: number;
+        changed_since_review: boolean;
+    }[];
+    reviewers: Record<string, number>;
+    other_files: number;
+    set_aside: number;
+};

package/dist/review/receipt.js

@@ -0,0 +1,73 @@
+/**
+ * The quality receipt for a change: for every changed function outside tests, what is known about
+ * it before a model looks at anything.
+ *
+ * - reviewed: risky, and reviewed at its current code during development (the ledger or a
+ *   committed reviewed.json, keyed by the function's exact source);
+ * - changed since review: risky, reviewed once, then edited, so that review no longer counts;
+ * - low risk: below the router's bar, left to the deterministic checks;
+ * - not covered: risky with no review of this code. These are what a PR review should spend on.
+ *
+ * Reviews are agents' and people's own records. An independent (enforcing) review does not count
+ * them, and the receipt says how many it set aside rather than hiding them.
+ */
+import { DEFAULT_MIN_SCORE } from '../deep/router.js';
+import { rankChangedFunctions } from '../deep/risk.js';
+import { activeLessons, DEFAULT_LESSON_MODE } from '../review-learning/team-lessons.js';
+import { changedLinesByFile, parseDiff, removedByFile } from '../utils/diff.js';
+import { isReviewed, readLedger, reviewedKeys } from './ledger.js';
+const PARSEABLE = /\.(?:[cm]?[jt]sx?)$/i;
+export function buildQualityReceipt(cwd, diff, options = {}) {
+    const changed = changedLinesByFile(parseDiff(diff));
+    const ranked = rankChangedFunctions(cwd, changed, removedByFile(diff), activeLessons(cwd, options.lessonMode ?? DEFAULT_LESSON_MODE));
+    const minScore = options.policy?.min_score ?? DEFAULT_MIN_SCORE;
+    const risky = ranked.filter(f => f.score >= minScore);
+    const recorded = reviewedKeys(cwd);
+    const trusted = options.independent ? [] : recorded;
+    const reviewedNow = risky.filter(f => isReviewed(trusted, keyOf(f)));
+    const gaps = risky.filter(f => !isReviewed(trusted, keyOf(f)));
+    return {
+        functions: ranked.length,
+        reviewed: reviewedNow.length,
+        changedSinceReview: gaps.filter(f => reviewedBefore(recorded, f)).length,
+        lowRisk: ranked.length - risky.length,
+        notCovered: gaps.map(f => ({
+            file: f.file, function: f.name, start: f.start, score: f.score,
+            changedSinceReview: reviewedBefore(recorded, f),
+            ...(f.signals.lesson ? { lesson: f.signals.lesson } : {}),
+        })),
+        reviewers: reviewersOf(cwd, reviewedNow),
+        otherFiles: Object.keys(changed).filter(file => !PARSEABLE.test(file)).length,
+        setAside: options.independent ? risky.filter(f => isReviewed(recorded, keyOf(f))).length : 0,
+    };
+}
+function keyOf(f) {
+    return { file: f.file, function: f.name, hash: f.hash };
+}
+/** Some version of this function was reviewed, just not the code it has now. */
+function reviewedBefore(recorded, f) {
+    return recorded.some(r => r.file === f.file && r.function === f.name && r.hash !== f.hash);
+}
+function reviewersOf(cwd, reviewed) {
+    const ledger = readLedger(cwd);
+    const counts = {};
+    for (const f of reviewed) {
+        const entry = [...ledger].reverse().find(e => e.file === f.file && e.function === f.name && e.hash === f.hash);
+        const who = entry ? (entry.reviewer.startsWith('byok:') ? 'model' : entry.reviewer) : 'recorded';
+        counts[who] = (counts[who] ?? 0) + 1;
+    }
+    return counts;
+}
+/** The receipt as reports carry it (snake_case, like the rest of `rigour review --json` and the MCP tool). */
+export function receiptReport(r) {
+    return {
+        functions: r.functions,
+        reviewed: r.reviewed,
+        changed_since_review: r.changedSinceReview,
+        low_risk: r.lowRisk,
+        not_covered: r.notCovered.map(g => ({ file: g.file, function: g.function, line: g.start, score: g.score, changed_since_review: g.changedSinceReview, ...(g.lesson ? { lesson: g.lesson } : {}) })),
+        reviewers: r.reviewers,
+        other_files: r.otherFiles,
+        set_aside: r.setAside,
+    };
+}

package/dist/review/receipt.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/review/receipt.test.js

@@ -0,0 +1,60 @@
+import { execFileSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { findFunction } from '../deep/risk.js';
+import { diffFromGit } from './git-diff.js';
+import { recordReview } from './ledger.js';
+import { buildQualityReceipt } from './receipt.js';
+let repo;
+const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' });
+const write = (rel, body) => { fs.mkdirSync(path.dirname(path.join(repo, rel)), { recursive: true }); fs.writeFileSync(path.join(repo, rel), body); };
+const review = (file, fn, reviewer = 'agent') => {
+    const found = findFunction(repo, file, fn);
+    recordReview(repo, { file, function: fn, hash: found.hash, reviewer, verdict: 'no_issue', note: 'checked' });
+};
+beforeEach(() => {
+    repo = fs.mkdtempSync(path.join(os.tmpdir(), 'receipt-'));
+    git('init', '-q', '-b', 'main');
+    git('config', 'user.email', 't@example.com');
+    git('config', 'user.name', 't');
+    git('config', 'commit.gpgsign', 'false');
+    write('.gitignore', '.rigour/\n');
+    write('src/pay.ts', 'export const x = 1;\n');
+    git('add', '-A');
+    git('commit', '-qm', 'init');
+});
+afterEach(() => fs.rmSync(repo, { recursive: true, force: true }));
+// Risky: a data write. Low risk: a formatter. Each in its own function.
+const RISKY = (n) => `export async function saveRefund${n}(db: any, cents: number) {\n  return db.insert({ cents: cents + ${n} });\n}\n`;
+const PLAIN = 'export function label(name: string) {\n  return name.trim();\n}\n';
+describe('buildQualityReceipt', () => {
+    it('says what was reviewed at its current code, what changed after review, what is low risk, and what is not covered', () => {
+        write('src/pay.ts', RISKY(1) + RISKY(2) + RISKY(3) + PLAIN);
+        write('config/app.yml', 'a: 1\n');
+        review('src/pay.ts', 'saveRefund1');
+        review('src/pay.ts', 'saveRefund2');
+        write('src/pay.ts', RISKY(1) + RISKY(2).replace('cents + 2', 'cents + 20') + RISKY(3) + PLAIN); // edited after its review
+        const receipt = buildQualityReceipt(repo, diffFromGit(repo));
+        expect(receipt).toMatchObject({ functions: 4, reviewed: 1, changedSinceReview: 1, lowRisk: 1, otherFiles: 1, setAside: 0, reviewers: { agent: 1 } });
+        expect(receipt.notCovered.map(g => [g.function, g.changedSinceReview])).toEqual([['saveRefund2', true], ['saveRefund3', false]]);
+    });
+    it('counts no self-reported review when independent, and says how many it set aside', () => {
+        write('src/pay.ts', RISKY(1) + RISKY(2));
+        review('src/pay.ts', 'saveRefund1');
+        const receipt = buildQualityReceipt(repo, diffFromGit(repo), { independent: true });
+        expect(receipt).toMatchObject({ reviewed: 0, setAside: 1 });
+        expect(receipt.notCovered).toHaveLength(2);
+    });
+    it('treats a function matching a verified team lesson as risky, and says which lesson', () => {
+        write('src/pay.ts', 'export function formatTotal(totalCents: number) {\n  return (totalCents / 100).toFixed(2);\n}\n');
+        write('.rigour/review-lessons.json', JSON.stringify({ version: 1, lessons: [{
+                    id: 'l1', text: 'Format money from integer cents, never floats.', file: 'src/pay.ts', symbols: ['totalCents'],
+                    state: 'verified', evidence: [{ pr: 12, comment: 'c', author: 'reviewer' }], createdAt: '', updatedAt: '',
+                }] }));
+        const withLesson = buildQualityReceipt(repo, diffFromGit(repo));
+        expect(withLesson.notCovered).toEqual([expect.objectContaining({ function: 'formatTotal', lesson: 'Format money from integer cents, never floats.' })]);
+        expect(buildQualityReceipt(repo, diffFromGit(repo), { lessonMode: 'off' }).notCovered).toEqual([]);
+    });
+});

package/dist/review/review-task.d.ts

@@ -9,6 +9,7 @@
  * pre-empted four times as many acted-on review comments as chunked prompts.
  */
 import { type RouterPolicy } from '../deep/router.js';
+import { type ReviewedKey } from './ledger.js';
 import { type LessonMode } from '../review-learning/team-lessons.js';
 export interface ReviewTaskItem {
     file: string;
@@ -37,4 +38,5 @@ export interface ReviewTask {
     }>;
     instructions: string;
 }
-export declare function buildReviewTask(cwd: string, diff: string, policy?: RouterPolicy, lessonMode?: LessonMode, repoRules?: boolean): ReviewTask;
+/** `reviewed`: the reviews to trust; an independent (enforcing) review passes none, so self-reported reviews skip nothing. */
+export declare function buildReviewTask(cwd: string, diff: string, policy?: RouterPolicy, lessonMode?: LessonMode, repoRules?: boolean, reviewed?: ReviewedKey[]): ReviewTask;

package/dist/review/review-task.js

@@ -12,7 +12,7 @@ import { DEFAULT_MAX_FUNCTIONS, DEFAULT_MIN_SCORE } from '../deep/router.js';
 import { rankChangedFunctions } from '../deep/risk.js';
 import { changedLinesByFile, parseDiff, removedByFile } from '../utils/diff.js';
 import { isReviewed, reviewedKeys } from './ledger.js';
-import { lessonsForDiff } from '../review-learning/team-lessons.js';
+import { activeLessons, DEFAULT_LESSON_MODE, lessonsForDiff } from '../review-learning/team-lessons.js';
 import { rulesForDiff } from '../review-learning/repo-rules.js';
 const QUESTIONS = {
     'data-write': 'Is the write safe under concurrent calls (no check-then-act), idempotent on retry, and does an upsert/conflict clause do what the caller expects?',
@@ -22,11 +22,11 @@ const QUESTIONS = {
     concurrency: 'What happens if two calls overlap, or one step fails half-way through?',
     network: 'Are timeouts, aborts and non-2xx responses handled, and does a retry repeat a side effect?',
 };
-export function buildReviewTask(cwd, diff, policy = {}, lessonMode = 'off', repoRules = false) {
+/** `reviewed`: the reviews to trust; an independent (enforcing) review passes none, so self-reported reviews skip nothing. */
+export function buildReviewTask(cwd, diff, policy = {}, lessonMode = DEFAULT_LESSON_MODE, repoRules = false, reviewed = reviewedKeys(cwd)) {
     const changed = parseDiff(diff);
-    const ranked = rankChangedFunctions(cwd, changedLinesByFile(changed), removedByFile(diff));
+    const ranked = rankChangedFunctions(cwd, changedLinesByFile(changed), removedByFile(diff), activeLessons(cwd, lessonMode));
     const risky = ranked.filter(f => f.score >= (policy.min_score ?? DEFAULT_MIN_SCORE)).slice(0, policy.max_functions ?? DEFAULT_MAX_FUNCTIONS);
-    const reviewed = reviewedKeys(cwd);
     const pending = risky.filter(f => !isReviewed(reviewed, { file: f.file, function: f.name, hash: f.hash }));
     const lessons = lessonsForDiff(cwd, diff, lessonMode).map(l => ({ file: l.file, text: l.text, prs: [...new Set(l.evidence.map(e => e.pr))] }));
     return {
@@ -42,6 +42,7 @@ export function buildReviewTask(cwd, diff, policy = {}, lessonMode = 'off', repo
 }
 function toItem(f) {
     const questions = [
+        ...(f.signals.lesson ? [`Your team flagged this before: "${f.signals.lesson}" Does this change repeat it?`] : []),
         ...(f.signals.removedGuard ? ['The change removed a condition, return or throw here: which inputs did it guard against, and are they still handled?'] : []),
         ...f.signals.sensitive.map(kind => QUESTIONS[kind]).filter(Boolean),
         `Do the callers of \`${f.name}\` still get what they assume (types, empty and error cases)?`,

package/dist/review/review-task.test.js

@@ -8,6 +8,7 @@ import { acknowledgeReview } from './review-ack.js';
 import { buildReviewTask } from './review-task.js';
 import { exportReviewed, readLedger, REVIEWED_FILE } from './ledger.js';
 import { reviewAckMessage } from '../hooks/stop-review.js';
+import { writeLessons } from '../review-learning/lessons.js';
 let repo;
 const git = (...args) => execFileSync('git', ['-C', repo, ...args], { encoding: 'utf8' });
 const write = (body) => fs.writeFileSync(path.join(repo, 'sync.ts'), body);
@@ -51,6 +52,14 @@ describe('review task and acknowledgements', () => {
         expect(task.items[0].questions[0]).toMatch(/concurrent calls/);
         expect(task.items[0].questions.at(-1)).toContain('`syncOrders`');
     });
+    it('sends a function a verified team lesson names to review, and asks whether the change repeats it', () => {
+        write(AFTER.replace('name.trim()', 'name.toLocaleUpperCase()'));
+        writeLessons(repo, [{ id: 'l1', text: 'Locale casing breaks Turkish names.', file: 'sync.ts', symbols: ['toLocaleUpperCase'], state: 'verified', evidence: [{ pr: 7, comment: 'c1', author: 'r' }], createdAt: '', updatedAt: '' }]);
+        const task = buildReviewTask(repo, diffFromGit(repo));
+        const label = task.items.find(i => i.function === 'label');
+        expect(label?.questions[0]).toContain('Locale casing breaks Turkish names.');
+        expect(buildReviewTask(repo, diffFromGit(repo), {}, 'off').items.map(i => i.function)).toEqual(['syncOrders']);
+    });
     it('drops an acknowledged function from the task until its code changes again', () => {
         const ack = acknowledgeReview(repo, { file: 'sync.ts', function: 'syncOrders', verdict: 'no_issue', note: 'upsert key is the unique order id; callers retry safely' });
         expect(ack.ok).toBe(true);

package/dist/review-learning/team-lessons.d.ts

@@ -1,4 +1,8 @@
 import { type ReviewLesson } from './lessons.js';
 export type LessonMode = 'verified' | 'all' | 'off';
+/** Lessons a person or repeated evidence verified reach the reviewer unless a team turns them off. */
+export declare const DEFAULT_LESSON_MODE: LessonMode;
+/** The team's review lessons in play for this mode: none when off, verified ones by default. */
+export declare function activeLessons(cwd: string, mode?: LessonMode): ReviewLesson[];
 export declare function lessonsForDiff(cwd: string, diff: string, mode?: LessonMode): ReviewLesson[];
 export declare function lessonsSection(lessons: ReviewLesson[]): string;

package/dist/review-learning/team-lessons.js

@@ -5,7 +5,15 @@
  */
 import { parseDiff } from '../utils/diff.js';
 import { matchLessons, readLessons } from './lessons.js';
-export function lessonsForDiff(cwd, diff, mode = 'off') {
+/** Lessons a person or repeated evidence verified reach the reviewer unless a team turns them off. */
+export const DEFAULT_LESSON_MODE = 'verified';
+/** The team's review lessons in play for this mode: none when off, verified ones by default. */
+export function activeLessons(cwd, mode = DEFAULT_LESSON_MODE) {
+    if (mode === 'off')
+        return [];
+    return readLessons(cwd).filter(l => mode === 'all' || l.state === 'verified');
+}
+export function lessonsForDiff(cwd, diff, mode = DEFAULT_LESSON_MODE) {
     if (mode === 'off')
         return [];
     const lessons = readLessons(cwd);

package/dist/telemetry/telemetry.js

@@ -44,8 +44,10 @@ export function setTelemetryEnabled(enabled, home = os.homedir()) {
     writeJson(file(home, 'telemetry.json'), state);
     return state;
 }
+/** CI systems by the variable each always sets; Jenkins, Azure Pipelines and TeamCity do not set CI. */
+const CI_MARKERS = ['CI', 'GITHUB_ACTIONS', 'BUILDKITE', 'GITLAB_CI', 'CIRCLECI', 'JENKINS_URL', 'TF_BUILD', 'TEAMCITY_VERSION'];
 function isCi(env) {
-    return !!(env.CI || env.GITHUB_ACTIONS || env.BUILDKITE || env.GITLAB_CI || env.CIRCLECI);
+    return CI_MARKERS.some(name => !!env[name]);
 }
 /** Opted out by the environment, whatever the stored answer. */
 function vetoed(env) {

package/dist/telemetry/telemetry.test.js

@@ -22,6 +22,11 @@ describe('telemetry consent', () => {
     it('never asks in CI or without a terminal, and keeps one random install id', () => {
         expect(shouldAskTelemetry(false, { env, home })).toBe(false);
         expect(shouldAskTelemetry(true, { env: { ...env, GITHUB_ACTIONS: 'true' }, home })).toBe(false);
+        setTelemetryEnabled(true, home);
+        for (const ci of ['JENKINS_URL', 'TF_BUILD', 'TEAMCITY_VERSION']) {
+            expect(isTelemetryEnabled({ env: { ...env, [ci]: 'x' }, home })).toBe(false); // a build agent's stored yes is not a CI opt-in
+            expect(isTelemetryEnabled({ env: { ...env, [ci]: 'x', RIGOUR_TELEMETRY: '1' }, home })).toBe(true);
+        }
         const first = setTelemetryEnabled(false, home).installId;
         expect(readTelemetryState(home).installId).toBe(first);
         expect(first).toMatch(/^[0-9a-f-]{36}$/);

package/dist/types/index.js

@@ -333,7 +333,7 @@ export const GatesSchema = z.object({
         budget_ms: z.number().optional(), // whole deep run; files not started in time are reported as skipped
         agentic: z.boolean().optional(), // cloud tier: the model may read the repository while it reviews (default true)
         repo_rules: z.boolean().optional(), // show the reviewer the rules in AGENTS.md / CLAUDE.md / Cursor rules that name what the change touches (default false)
-        review_lessons: z.enum(['verified', 'all', 'off']).optional(), // the team's past review lessons shown to the reviewer: off (default), verified, or all
+        review_lessons: z.enum(['verified', 'all', 'off']).optional(), // the team's past review lessons: they raise a function's risk and are shown to the reviewer. verified (default), all, or off
         router: z.object({
             enabled: z.boolean().optional(), // default true
             min_score: z.number().optional(), // functions below this get the deterministic gates only

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.6.0",
+  "version": "6.6.2",
   "description": "Rigour's review engine: deterministic gates on changed lines, rules and lessons learned from your team's fixes, and per-check precision from what you fix versus dismiss, across TypeScript, JavaScript, Python, Go, Ruby and C#.",
   "engines": {
     "node": ">=22"
@@ -70,11 +70,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.6.0",
-    "@rigour-labs/brain-darwin-x64": "6.6.0",
-    "@rigour-labs/brain-linux-arm64": "6.6.0",
-    "@rigour-labs/brain-linux-x64": "6.6.0",
-    "@rigour-labs/brain-win-x64": "6.6.0"
+    "@rigour-labs/brain-darwin-x64": "6.6.2",
+    "@rigour-labs/brain-linux-x64": "6.6.2",
+    "@rigour-labs/brain-linux-arm64": "6.6.2",
+    "@rigour-labs/brain-darwin-arm64": "6.6.2",
+    "@rigour-labs/brain-win-x64": "6.6.2"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",