aidimag 1.0.0

package/dist/ui/server.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `dim ui` — local web dashboard (zero extra dependencies, node:http only).
+ *
+ * Serves a single-page UI: memory list with trust badges, proposal review
+ * queue, verify buttons, and a force-directed graph of memories ↔ scope paths
+ * (D3 from CDN). Works alongside any IDE; later IDE extensions can embed this
+ * same dashboard in a webview.
+ */
+import type { MemoryStore } from "../db/store.js";
+export declare function startUiServer(store: MemoryStore, repoRoot: string, port?: number): Promise<string>;

package/dist/ui/server.js

@@ -0,0 +1,437 @@
+/**
+ * `dim ui` — local web dashboard (zero extra dependencies, node:http only).
+ *
+ * Serves a single-page UI: memory list with trust badges, proposal review
+ * queue, verify buttons, and a force-directed graph of memories ↔ scope paths
+ * (D3 from CDN). Works alongside any IDE; later IDE extensions can embed this
+ * same dashboard in a webview.
+ */
+import { createServer } from "node:http";
+import { watch, mkdirSync } from "node:fs";
+import path from "node:path";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { verifyAll } from "../verify/engine.js";
+import { mineCommits } from "../capture/commit-miner.js";
+import { hybridSearch, indexMemory, reindexAll } from "../embeddings/search.js";
+import { readCloudConfig, writeCloudConfig, saveToken, getToken, sync as cloudSync } from "../sync/client.js";
+import { resolveKnowledgeConfig } from "../config.js";
+import { ingestAll } from "../knowledge/ingest.js";
+import { isAllowedSyncServerUrl } from "../security/url.js";
+import { readTicketsConfig, writeTicketsConfig, saveTicketCredential, getTicketCredential, ticketProviderFor, DEFAULT_TICKET_PATTERN, } from "../tickets/provider.js";
+import { PAGE_HTML } from "./page.js";
+function json(res, code, body) {
+    res.writeHead(code, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(body));
+}
+function readBody(req) {
+    const MAX_BODY_BYTES = 5 * 1024 * 1024; // 5 MiB — bound memory use on POST bodies
+    return new Promise((resolve, reject) => {
+        let body = "";
+        let size = 0;
+        req.on("data", (d) => {
+            size += d.length;
+            if (size > MAX_BODY_BYTES) {
+                reject(new Error("request body too large"));
+                req.destroy();
+                return;
+            }
+            body += d;
+        });
+        req.on("end", () => {
+            try {
+                resolve(body ? JSON.parse(body) : {});
+            }
+            catch (err) {
+                reject(err);
+            }
+        });
+        req.on("error", reject);
+    });
+}
+export function startUiServer(store, repoRoot, port = 4517) {
+    const csrfToken = randomBytes(32).toString("base64url");
+    const isMutation = (method) => method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
+    const requireCsrf = (req) => {
+        const header = req.headers["x-aidimag-csrf-token"];
+        const got = (Array.isArray(header) ? header[0] : header) ?? "";
+        const a = Buffer.from(String(got));
+        const b = Buffer.from(csrfToken);
+        return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
+    };
+    // Auto-sync with the linked team server every N minutes while the dashboard
+    // runs (AIDIMAG_AUTOSYNC_MINUTES, default 10, 0 disables). Failures are
+    // silent — the next manual sync or dashboard action surfaces them.
+    const autoSyncMinutes = Number(process.env.AIDIMAG_AUTOSYNC_MINUTES ?? "10");
+    if (autoSyncMinutes > 0) {
+        const timer = setInterval(() => {
+            const cloud = readCloudConfig(repoRoot);
+            if (!cloud || !getToken(cloud.server))
+                return;
+            cloudSync(store, repoRoot).catch(() => undefined);
+        }, autoSyncMinutes * 60 * 1000);
+        timer.unref(); // never keep the process alive on its own
+    }
+    // Knowledge inbox watcher: auto-summarize docs dropped while the dashboard is up
+    // (the design's "automatic on drop while a long-running host is running" trigger).
+    // Best-effort and debounced; failures are silent, the next `dim knowledge sync` retries.
+    {
+        const cfg = resolveKnowledgeConfig(repoRoot);
+        const inbox = path.join(repoRoot, cfg.folder);
+        try {
+            mkdirSync(inbox, { recursive: true });
+            let running = false;
+            let queued = false;
+            let debounce;
+            const drain = async () => {
+                if (running) {
+                    queued = true;
+                    return;
+                }
+                running = true;
+                try {
+                    const report = await ingestAll(store, repoRoot, cfg);
+                    if (report.processed.length) {
+                        console.log(`dim ui: ingested ${report.processed.length} knowledge doc(s) → review queue`);
+                    }
+                }
+                catch { /* best-effort */ }
+                finally {
+                    running = false;
+                    if (queued) {
+                        queued = false;
+                        void drain();
+                    }
+                }
+            };
+            const watcher = watch(inbox, { persistent: false }, () => {
+                if (debounce)
+                    clearTimeout(debounce);
+                debounce = setTimeout(() => void drain(), 750);
+            });
+            watcher.unref?.();
+            void drain(); // catch up on anything already waiting
+        }
+        catch { /* watch unsupported on this platform — CLI sync still works */ }
+    }
+    const server = createServer(async (req, res) => {
+        const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+        const path = url.pathname;
+        try {
+            if (isMutation(req.method) && !requireCsrf(req)) {
+                json(res, 403, { error: "forbidden" });
+                return;
+            }
+            if (req.method === "GET" && path === "/") {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(PAGE_HTML);
+                return;
+            }
+            if (req.method === "GET" && path === "/api/state") {
+                const cloud = readCloudConfig(repoRoot);
+                const tcfg = readTicketsConfig(repoRoot);
+                json(res, 200, {
+                    repoRoot,
+                    csrfToken,
+                    memories: store.list(1000),
+                    proposals: store.listProposals("PENDING", 200),
+                    summary: store.statusSummary(),
+                    cloud: cloud
+                        ? { server: cloud.server, brain: cloud.brain, hasToken: !!getToken(cloud.server) }
+                        : null,
+                    tickets: tcfg.provider
+                        ? {
+                            provider: tcfg.provider,
+                            baseUrl: tcfg.baseUrl ?? null,
+                            pattern: tcfg.pattern ?? DEFAULT_TICKET_PATTERN,
+                            hasCredential: tcfg.provider === "remote"
+                                ? !!(cloud && getToken(cloud.server))
+                                : !!getTicketCredential(tcfg.baseUrl ?? "linear"),
+                            branch: tcfg.branch ?? null,
+                        }
+                        : null,
+                    vecAvailable: store.vecAvailable,
+                });
+                return;
+            }
+            // ---- search (hybrid when embeddings configured) ----
+            if (req.method === "GET" && path === "/api/search") {
+                const { results, semantic } = await hybridSearch(store, {
+                    query: url.searchParams.get("q") ?? "",
+                    kind: url.searchParams.get("kind") || undefined,
+                    paths: url.searchParams.get("path") ? [url.searchParams.get("path")] : undefined,
+                    limit: 50,
+                    includeRefuted: url.searchParams.get("all") === "1",
+                });
+                json(res, 200, { results, semantic });
+                return;
+            }
+            // ---- create memory (dim remember) ----
+            if (req.method === "POST" && path === "/api/memories") {
+                const b = await readBody(req);
+                if (!b.kind || !b.claim) {
+                    json(res, 400, { error: "kind and claim are required" });
+                    return;
+                }
+                const entry = store.write({
+                    kind: b.kind,
+                    claim: String(b.claim),
+                    paths: b.paths ?? [],
+                    symbols: b.symbols ?? [],
+                    evidence: b.evidence ?? [],
+                    createdBy: "human:dashboard",
+                    pinned: Boolean(b.pinned),
+                    guardrailLevel: b.guardrailLevel,
+                });
+                await indexMemory(store, entry).catch(() => false);
+                json(res, 201, { memory: entry });
+                return;
+            }
+            if (req.method === "POST" && path === "/api/verify") {
+                const deep = url.searchParams.get("deep") === "1";
+                json(res, 200, verifyAll(store, repoRoot, { deep }));
+                return;
+            }
+            // ---- mine git history ----
+            if (req.method === "POST" && path === "/api/mine") {
+                const full = url.searchParams.get("full") === "1";
+                const r = mineCommits(store, repoRoot, { full });
+                json(res, 200, {
+                    scanned: r.scanned,
+                    proposed: r.proposed.length,
+                    skipped: r.skippedDuplicates,
+                    noCommits: r.noCommits ?? false,
+                    noNewCommits: r.noNewCommits ?? false,
+                    cursor: r.lastSha,
+                });
+                return;
+            }
+            // ---- embeddings reindex ----
+            if (req.method === "POST" && path === "/api/reindex") {
+                const r = await reindexAll(store);
+                json(res, 200, {
+                    indexed: r.indexed,
+                    provider: r.provider ? `${r.provider.name}/${r.provider.model}` : null,
+                });
+                return;
+            }
+            // ---- team sync ----
+            if (req.method === "POST" && path === "/api/sync") {
+                const r = await cloudSync(store, repoRoot);
+                json(res, 200, r);
+                return;
+            }
+            // ---- cloud link/unlink ----
+            if (req.method === "POST" && path === "/api/cloud/link") {
+                const b = await readBody(req);
+                if (!b.server || !b.brain) {
+                    json(res, 400, { error: "server and brain are required" });
+                    return;
+                }
+                const serverUrl = String(b.server).replace(/\/$/, "");
+                if (!isAllowedSyncServerUrl(serverUrl)) {
+                    json(res, 400, { error: "invalid server URL" });
+                    return;
+                }
+                writeCloudConfig(repoRoot, { server: serverUrl, brain: String(b.brain) });
+                if (b.token)
+                    saveToken(serverUrl, String(b.token));
+                json(res, 200, { ok: true, hasToken: !!getToken(serverUrl) });
+                return;
+            }
+            if (req.method === "POST" && path === "/api/cloud/unlink") {
+                writeCloudConfig(repoRoot, { server: "", brain: "" });
+                json(res, 200, { ok: true });
+                return;
+            }
+            // ---- tickets (T2 connect + T3 team share) ----
+            if (req.method === "POST" && path === "/api/tickets/connect") {
+                const b = await readBody(req);
+                const provider = String(b.provider ?? "");
+                if (!["jira", "github", "linear", "http", "remote"].includes(provider)) {
+                    json(res, 400, { error: "provider must be jira | github | linear | http | remote" });
+                    return;
+                }
+                const baseUrl = b.baseUrl ? String(b.baseUrl).replace(/\/$/, "") : undefined;
+                if (!baseUrl && !["linear", "remote"].includes(provider)) {
+                    json(res, 400, { error: `baseUrl is required for ${provider}` });
+                    return;
+                }
+                const existing = readTicketsConfig(repoRoot);
+                writeTicketsConfig(repoRoot, {
+                    ...existing,
+                    provider: provider,
+                    baseUrl,
+                    pattern: b.pattern ??
+                        existing.pattern ??
+                        (provider === "github" ? "#\\d+" : DEFAULT_TICKET_PATTERN),
+                });
+                if (b.token)
+                    saveTicketCredential(baseUrl ?? "linear", String(b.token));
+                // trust-building: optional live validation round-trip
+                let validated = null;
+                if (b.testId) {
+                    const p = ticketProviderFor(repoRoot);
+                    const t = p ? await p.getTicket(String(b.testId)).catch(() => null) : null;
+                    if (t)
+                        validated = { id: t.id, title: t.title };
+                }
+                json(res, 200, { ok: true, validated });
+                return;
+            }
+            if (req.method === "POST" && path === "/api/tickets/disconnect") {
+                const existing = readTicketsConfig(repoRoot);
+                writeTicketsConfig(repoRoot, { branch: existing.branch }); // keep branch rules
+                json(res, 200, { ok: true });
+                return;
+            }
+            if (req.method === "GET" && path === "/api/tickets/show") {
+                const ticketId = url.searchParams.get("id");
+                if (!ticketId) {
+                    json(res, 400, { error: "missing ?id=" });
+                    return;
+                }
+                const p = ticketProviderFor(repoRoot);
+                if (!p) {
+                    json(res, 400, { error: "no ticket provider connected (or credential missing)" });
+                    return;
+                }
+                const t = await p.getTicket(ticketId);
+                if (!t)
+                    json(res, 404, { error: `ticket ${ticketId} not found` });
+                else
+                    json(res, 200, { ticket: t });
+                return;
+            }
+            // admin: push/remove team-shared credentials on the sync server
+            // (proxied like /api/keys — the admin token is per-request, never stored)
+            if (req.method === "POST" && path === "/api/tickets/share") {
+                const b = await readBody(req);
+                const cloud = readCloudConfig(repoRoot);
+                if (!cloud) {
+                    json(res, 400, { error: "repo is not cloud-linked — link a team server first" });
+                    return;
+                }
+                const admin = String(b.adminToken ?? "");
+                if (!admin) {
+                    json(res, 400, { error: "adminToken is required" });
+                    return;
+                }
+                const endpoint = `${cloud.server}/v1/ticket-config?brain=${encodeURIComponent(cloud.brain)}`;
+                const headers = { "Content-Type": "application/json", Authorization: `Bearer ${admin}` };
+                const upstream = b.remove
+                    ? await fetch(endpoint, { method: "DELETE", headers })
+                    : await fetch(endpoint, {
+                        method: "PUT",
+                        headers,
+                        body: JSON.stringify({ provider: b.provider, baseUrl: b.baseUrl ?? "", credential: b.credential }),
+                    });
+                json(res, upstream.status, await upstream.json());
+                return;
+            }
+            // ---- API key management (proxies to the sync server; admin token is
+            //      passed per-request from the UI and never stored) ----
+            if (path === "/api/keys") {
+                const b = req.method === "GET" ? {} : await readBody(req);
+                const cloud = readCloudConfig(repoRoot);
+                // Admin token is sent in a header (or POST body) — never the query
+                // string — so it can't leak into browser history, proxy/access logs.
+                const headerToken = req.headers["x-aidimag-admin-token"];
+                const target = String(b.server ?? url.searchParams.get("server") ?? cloud?.server ?? "");
+                if (cloud && target && target.replace(/\/$/, "") !== cloud.server.replace(/\/$/, "")) {
+                    json(res, 400, { error: "server must match linked cloud config" });
+                    return;
+                }
+                const admin = String(b.adminToken ??
+                    (Array.isArray(headerToken) ? headerToken[0] : headerToken) ??
+                    "");
+                if (!target || !admin) {
+                    json(res, 400, { error: "server and adminToken are required" });
+                    return;
+                }
+                const headers = { "Content-Type": "application/json", Authorization: `Bearer ${admin}` };
+                let upstream;
+                if (req.method === "POST" && !b.revoke) {
+                    upstream = await fetch(`${target}/v1/keys`, {
+                        method: "POST",
+                        headers,
+                        body: JSON.stringify({ brain: b.brain, label: b.label }),
+                    });
+                }
+                else if (req.method === "POST" && b.revoke) {
+                    upstream = await fetch(`${target}/v1/keys?key=${encodeURIComponent(String(b.revoke))}`, {
+                        method: "DELETE",
+                        headers,
+                    });
+                }
+                else {
+                    upstream = await fetch(`${target}/v1/keys`, { headers });
+                }
+                json(res, upstream.status, await upstream.json());
+                return;
+            }
+            // POST /api/proposals/:id/(approve|reject)
+            const propMatch = path.match(/^\/api\/proposals\/([^/]+)\/(approve|reject)$/);
+            if (req.method === "POST" && propMatch) {
+                const [, id, action] = propMatch;
+                if (action === "approve") {
+                    const memory = store.approveProposal(id);
+                    await indexMemory(store, memory).catch(() => false);
+                    json(res, 200, { memory });
+                }
+                else
+                    json(res, 200, { proposal: store.rejectProposal(id) });
+                return;
+            }
+            // POST /api/memories/:id/(refute|forget|pin|unpin)
+            const memMatch = path.match(/^\/api\/memories\/([^/]+)\/(refute|forget|pin|unpin)$/);
+            if (req.method === "POST" && memMatch) {
+                const [, id, action] = memMatch;
+                const full = store.list(1000).find((m) => m.id === id || m.id.startsWith(id));
+                if (!full) {
+                    json(res, 404, { error: `no memory ${id}` });
+                    return;
+                }
+                if (action === "refute")
+                    store.refute(full.id);
+                else if (action === "forget")
+                    store.forget(full.id);
+                else
+                    store.setPinned(full.id, action === "pin");
+                json(res, 200, { ok: true });
+                return;
+            }
+            json(res, 404, { error: "not found" });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : "internal error";
+            console.error(`[dim ui] ${req.method} ${req.url}:`, msg);
+            json(res, 500, { error: msg });
+        }
+    });
+    return new Promise((resolve, reject) => {
+        const tryPort = (currentPort, maxAttempts = 10) => {
+            if (maxAttempts === 0) {
+                reject(new Error(`Could not find an available port after trying ${port}-${currentPort - 1}`));
+                return;
+            }
+            server.once("error", (err) => {
+                if (err.code === "EADDRINUSE") {
+                    console.log(`⚠ Port ${currentPort} is already in use, trying ${currentPort + 1}...`);
+                    server.removeAllListeners("error");
+                    tryPort(currentPort + 1, maxAttempts - 1);
+                }
+                else {
+                    reject(err);
+                }
+            });
+            server.listen(currentPort, "127.0.0.1", () => {
+                if (currentPort !== port) {
+                    console.log(`ℹ Started on port ${currentPort} (requested port ${port} was in use)`);
+                }
+                resolve(`http://localhost:${currentPort}`);
+            });
+        };
+        tryPort(port);
+    });
+}
+//# sourceMappingURL=server.js.map

package/dist/verify/check.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `dim check` (KARPATHY_LAYERS Feature 4) — Verifier layer, shifted left.
+ *
+ * Verification today runs *after* code lands (post-merge hook). `dim check`
+ * runs it against a diff BEFORE the commit, so contradictions are caught at
+ * author time. It analyzes `git diff --staged` (or an arbitrary ref) against
+ * the memories scoped to the changed files:
+ *
+ *   - STATIC_CHECK evidence → re-run; a FAIL means the change broke the claim
+ *   - GUARDRAIL (never)     → keyword-match the added lines against the claim
+ *   - INVARIANT / CONVENTION scoped to a changed file → advisory reminder
+ *
+ * Exit policy is the caller's: warn (exit 0) by default, block (exit 1) opt-in.
+ */
+import type { MemoryStore } from "../db/store.js";
+import type { MemoryEntry } from "../types.js";
+export interface DiffFile {
+    path: string;
+    addedLines: string[];
+}
+export type Severity = "fail" | "warn";
+export interface CheckViolation {
+    memory: MemoryEntry;
+    severity: Severity;
+    detail: string;
+}
+export interface CheckReport {
+    changedFiles: string[];
+    checked: number;
+    violations: CheckViolation[];
+}
+/** Parse a unified diff (—U0) into per-file added lines. */
+export declare function parseDiff(diff: string): DiffFile[];
+/** Run `git diff` for staged changes (default) or against a ref. */
+export declare function gitDiff(repoRoot: string, ref?: string): string;
+export declare function checkDiff(store: MemoryStore, repoRoot: string, opts?: {
+    ref?: string;
+}): CheckReport;

package/dist/verify/check.js

@@ -0,0 +1,121 @@
+/**
+ * `dim check` (KARPATHY_LAYERS Feature 4) — Verifier layer, shifted left.
+ *
+ * Verification today runs *after* code lands (post-merge hook). `dim check`
+ * runs it against a diff BEFORE the commit, so contradictions are caught at
+ * author time. It analyzes `git diff --staged` (or an arbitrary ref) against
+ * the memories scoped to the changed files:
+ *
+ *   - STATIC_CHECK evidence → re-run; a FAIL means the change broke the claim
+ *   - GUARDRAIL (never)     → keyword-match the added lines against the claim
+ *   - INVARIANT / CONVENTION scoped to a changed file → advisory reminder
+ *
+ * Exit policy is the caller's: warn (exit 0) by default, block (exit 1) opt-in.
+ */
+import { execFileSync } from "node:child_process";
+import { runEvidence } from "./runners.js";
+/** Parse a unified diff (—U0) into per-file added lines. */
+export function parseDiff(diff) {
+    const files = [];
+    let current = null;
+    for (const line of diff.split("\n")) {
+        const m = line.match(/^\+\+\+ b\/(.+)$/);
+        if (m) {
+            current = { path: m[1], addedLines: [] };
+            if (m[1] !== "/dev/null")
+                files.push(current);
+            continue;
+        }
+        if (current && line.startsWith("+") && !line.startsWith("+++")) {
+            current.addedLines.push(line.slice(1));
+        }
+    }
+    return files;
+}
+/** Run `git diff` for staged changes (default) or against a ref. */
+export function gitDiff(repoRoot, ref) {
+    const args = ref
+        ? ["diff", "--unified=0", `${ref}`, "--"]
+        : ["diff", "--cached", "--unified=0", "--"];
+    try {
+        return execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+    }
+    catch {
+        return "";
+    }
+}
+const STOP = new Set(["the", "a", "an", "and", "or", "to", "of", "in", "on", "for", "with", "never", "always", "must", "only", "not", "use", "via"]);
+function significantTokens(claim) {
+    return claim
+        .toLowerCase()
+        .split(/[^a-z0-9_./-]+/)
+        .filter((t) => t.length > 3 && !STOP.has(t));
+}
+/** A guardrail-never is "tripped" when added code contains enough of its key terms. */
+function guardrailTripped(claim, addedText) {
+    const tokens = significantTokens(claim);
+    if (tokens.length === 0)
+        return false;
+    const hay = addedText.toLowerCase();
+    const hits = tokens.filter((t) => hay.includes(t)).length;
+    return hits / tokens.length >= 0.6;
+}
+export function checkDiff(store, repoRoot, opts = {}) {
+    const diff = gitDiff(repoRoot, opts.ref);
+    const diffFiles = parseDiff(diff);
+    const changedFiles = diffFiles.map((f) => f.path);
+    const addedByFile = new Map(diffFiles.map((f) => [f.path, f.addedLines.join("\n")]));
+    if (changedFiles.length === 0) {
+        return { changedFiles, checked: 0, violations: [] };
+    }
+    // Active memories scoped to the changed files (skip refuted/stale — only
+    // currently-trusted beliefs gate a commit).
+    const memories = store
+        .getForFiles(changedFiles, 200)
+        .filter((m) => m.status === "VERIFIED" || m.status === "UNVERIFIED" || m.pinned);
+    const violations = [];
+    const seenIds = new Set();
+    for (const m of memories) {
+        seenIds.add(m.id);
+        // 1) re-run any STATIC_CHECK evidence against the working tree
+        for (const ev of m.grounding) {
+            if (ev.type !== "STATIC_CHECK")
+                continue;
+            const outcome = runEvidence(ev, repoRoot);
+            if (outcome.result === "FAIL") {
+                violations.push({
+                    memory: m,
+                    severity: "fail",
+                    detail: `STATIC_CHECK now fails (${outcome.detail}) — this change contradicts the claim`,
+                });
+            }
+        }
+        // 2) GUARDRAIL (never): pattern-match the added lines against the claim
+        if (m.kind === "GUARDRAIL" && m.guardrailLevel === "never") {
+            const added = m.scope.paths.length
+                ? m.scope.paths.flatMap((sp) => changedFiles.filter((f) => f.startsWith(sp) || sp.startsWith(f)).map((f) => addedByFile.get(f) ?? "")).join("\n")
+                : changedFiles.map((f) => addedByFile.get(f) ?? "").join("\n");
+            if (guardrailTripped(m.claim, added)) {
+                violations.push({
+                    memory: m,
+                    severity: "fail",
+                    detail: "🚫 NEVER guardrail: the staged change appears to do exactly what this forbids",
+                });
+            }
+        }
+        // 3) INVARIANT / CONVENTION scoped to a changed file → advisory reminder
+        if ((m.kind === "INVARIANT" || m.kind === "CONVENTION") && m.scope.paths.length) {
+            const touches = m.scope.paths.some((sp) => changedFiles.some((f) => f.startsWith(sp) || sp.startsWith(f)));
+            const hasStaticCheck = m.grounding.some((e) => e.type === "STATIC_CHECK");
+            if (touches && !hasStaticCheck) {
+                violations.push({
+                    memory: m,
+                    severity: "warn",
+                    detail: `${m.kind} covers a file you changed — make sure it still holds (no automated check attached)`,
+                });
+            }
+        }
+    }
+    return { changedFiles, checked: seenIds.size, violations };
+}
+//# sourceMappingURL=check.js.map

package/dist/verify/engine.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Verification engine (Phase 3) — runs evidence and applies the
+ * status lifecycle: UNVERIFIED/VERIFIED ↔ STALE. REFUTED stays a
+ * deliberate human/agent action, never automatic.
+ *
+ * Transition rules per memory:
+ *   - any runnable evidence FAILs            → STALE  (confidence floored)
+ *   - all runnable evidence PASSes (≥1)      → VERIFIED (confidence boosted)
+ *   - only skipped/unknown evidence, or none → status unchanged
+ *   - REFUTED memories are never re-verified (negative knowledge is final
+ *     until explicitly superseded)
+ */
+import { type RunOptions, type RunOutcome } from "./runners.js";
+import type { MemoryStore } from "../db/store.js";
+import type { MemoryEntry, MemoryStatus } from "../types.js";
+export interface MemoryVerification {
+    memoryId: string;
+    claim: string;
+    before: MemoryStatus;
+    after: MemoryStatus;
+    confidenceBefore: number;
+    confidenceAfter: number;
+    outcomes: RunOutcome[];
+    decayed?: boolean;
+}
+export interface VerifyReport {
+    checked: number;
+    verified: number;
+    stale: number;
+    unchanged: number;
+    decayed: number;
+    results: MemoryVerification[];
+}
+export declare function decayedConfidence(confidence: number, lastAnchorIso: string, halfLifeDays: number, now?: Date): number;
+export declare function verifyMemory(store: MemoryStore, memory: MemoryEntry, repoRoot: string, opts?: RunOptions): MemoryVerification;
+export declare function verifyAll(store: MemoryStore, repoRoot: string, opts?: {
+    ids?: string[];
+    deep?: boolean;
+}): VerifyReport;