aidimag 1.0.0

package/dist/verify/engine.js

@@ -0,0 +1,178 @@
+/**
+ * Verification engine (Phase 3) — runs evidence and applies the
+ * status lifecycle: UNVERIFIED/VERIFIED ↔ STALE. REFUTED stays a
+ * deliberate human/agent action, never automatic.
+ *
+ * Transition rules per memory:
+ *   - any runnable evidence FAILs            → STALE  (confidence floored)
+ *   - all runnable evidence PASSes (≥1)      → VERIFIED (confidence boosted)
+ *   - only skipped/unknown evidence, or none → status unchanged
+ *   - REFUTED memories are never re-verified (negative knowledge is final
+ *     until explicitly superseded)
+ */
+import { execFileSync } from "node:child_process";
+import { runEvidence } from "./runners.js";
+import { debugLog } from "../debug.js";
+const CONFIDENCE_BOOST = 0.1;
+const CONFIDENCE_CAP = 0.95;
+const CONFIDENCE_FLOOR_ON_FAIL = 0.2;
+// ---- confidence decay (Phase 5) -------------------------------------------
+// Memories that can't be re-verified this run decay exponentially with age.
+// HUMAN_ATTESTED-only memories decay fastest (weakest evidence per DESIGN.md).
+const DECAY_HALF_LIFE_DAYS = 45;
+const DECAY_HALF_LIFE_HUMAN_DAYS = 14;
+/** VERIFIED memories whose confidence decays below this demote to UNVERIFIED. */
+const DEMOTION_THRESHOLD = 0.35;
+const MIN_CONFIDENCE = 0.05;
+/** Ignore decay smaller than this — avoids noisy sub-percent updates on every run. */
+const DECAY_EPSILON = 0.01;
+export function decayedConfidence(confidence, lastAnchorIso, halfLifeDays, now = new Date()) {
+    const ageDays = (now.getTime() - new Date(lastAnchorIso).getTime()) / 86_400_000;
+    if (ageDays <= 0)
+        return confidence;
+    return Math.max(MIN_CONFIDENCE, confidence * Math.pow(0.5, ageDays / halfLifeDays));
+}
+function isHumanOnly(memory) {
+    return memory.grounding.length > 0 && memory.grounding.every((e) => e.type === "HUMAN_ATTESTED");
+}
+export function verifyMemory(store, memory, repoRoot, opts = {}) {
+    const outcomes = [];
+    const now = new Date().toISOString();
+    const runOpts = {
+        isTrusted: (payload) => store.isEvidencePayloadTrusted(payload),
+        ...opts,
+    };
+    for (const ev of memory.grounding) {
+        const outcome = runEvidence(ev, repoRoot, runOpts);
+        outcomes.push(outcome);
+        if (outcome.result !== "SKIPPED") {
+            store.updateEvidenceResult(ev.id, outcome.result, now);
+        }
+    }
+    // HUMAN_ATTESTED passes trivially; it re-anchors status but must NOT block
+    // decay, otherwise human-only memories would never age.
+    const machineRunnable = outcomes.filter((o) => (o.result === "PASS" || o.result === "FAIL") && o.type !== "HUMAN_ATTESTED");
+    const runnable = outcomes.filter((o) => o.result === "PASS" || o.result === "FAIL");
+    const anyFail = runnable.some((o) => o.result === "FAIL");
+    const allPass = runnable.length > 0 && runnable.every((o) => o.result === "PASS");
+    debugLog("verify", `${memory.id.slice(0, 8)} outcomes=${outcomes.length} runnable=${runnable.length} allPass=${allPass} status=${memory.status} verifiedAt=${memory.verifiedAt}`);
+    let after = memory.status;
+    let confidenceAfter = memory.confidence;
+    let decayed = false;
+    if (anyFail) {
+        after = "STALE";
+        confidenceAfter = Math.min(memory.confidence, CONFIDENCE_FLOOR_ON_FAIL);
+    }
+    else if (allPass && machineRunnable.length > 0) {
+        after = "VERIFIED";
+        confidenceAfter = Math.min(CONFIDENCE_CAP, memory.confidence + CONFIDENCE_BOOST);
+    }
+    else if (allPass && runnable.length > 0) {
+        // human-attested only: VERIFIED on first attestation, then decays from
+        // verified_at — re-running verify must not refresh human trust.
+        if (memory.verifiedAt === null && memory.status === "UNVERIFIED") {
+            after = "VERIFIED";
+            debugLog("verify", `${memory.id.slice(0, 8)} UNVERIFIED→VERIFIED (first human attestation)`);
+        }
+        else if (!memory.pinned) {
+            const next = decayedConfidence(memory.confidence, memory.verifiedAt ?? memory.createdAt, DECAY_HALF_LIFE_HUMAN_DAYS);
+            if (memory.confidence - next >= DECAY_EPSILON) {
+                confidenceAfter = next;
+                decayed = true;
+                if (memory.status === "VERIFIED" && next < DEMOTION_THRESHOLD)
+                    after = "UNVERIFIED";
+            }
+        }
+    }
+    else if (!memory.pinned) {
+        // nothing machine-checkable ran this round → decay with age.
+        // Pinned memories are exempt: the clock can't erode them — only a
+        // failing evidence run (handled above) can mark them STALE.
+        const halfLife = isHumanOnly(memory) ? DECAY_HALF_LIFE_HUMAN_DAYS : DECAY_HALF_LIFE_DAYS;
+        const anchor = memory.verifiedAt ?? memory.createdAt;
+        const next = decayedConfidence(memory.confidence, anchor, halfLife);
+        if (memory.confidence - next >= DECAY_EPSILON) {
+            confidenceAfter = next;
+            decayed = true;
+            if (memory.status === "VERIFIED" && next < DEMOTION_THRESHOLD) {
+                after = "UNVERIFIED"; // trust expired without re-confirmation
+            }
+        }
+    }
+    if (after !== memory.status)
+        store.setStatus(memory.id, after);
+    if (confidenceAfter !== memory.confidence)
+        store.setConfidence(memory.id, confidenceAfter);
+    // Touch verifiedAt when becoming VERIFIED (machine-runnable OR human-attested first verification)
+    if (after === "VERIFIED" && allPass) {
+        if (machineRunnable.length > 0 || memory.verifiedAt === null) {
+            store.touchVerified(memory.id);
+        }
+    }
+    return {
+        memoryId: memory.id,
+        claim: memory.claim,
+        before: memory.status,
+        after,
+        confidenceBefore: memory.confidence,
+        confidenceAfter,
+        outcomes,
+        decayed,
+    };
+}
+export function verifyAll(store, repoRoot, opts = {}) {
+    let memories = store.list(10_000).filter((m) => m.status !== "REFUTED");
+    if (opts.ids?.length) {
+        memories = memories.filter((m) => opts.ids.some((id) => m.id === id || m.id.startsWith(id)));
+    }
+    const results = memories.map((m) => verifyMemory(store, m, repoRoot, { deep: opts.deep }));
+    // Staleness is a capture trigger, not a dead end: when a memory NEWLY flips
+    // to STALE, draft a review-queue proposal so the human decides whether the
+    // code drifted (fix + re-verify) or the belief is outdated (approve the
+    // replacement / refute the original). Dedupe absorbs repeat runs.
+    for (const r of results) {
+        if (r.after !== "STALE" || r.before === "STALE")
+            continue;
+        const failed = r.outcomes.filter((o) => o.result === "FAIL");
+        store.propose({
+            kind: "TODO_CONTEXT",
+            claim: `Stale belief needs revisiting: "${r.claim.slice(0, 200)}" — its evidence now fails ` +
+                `(${failed.map((f) => `${f.type}: ${f.detail}`).join("; ").slice(0, 200)}). ` +
+                `Either the code drifted (fix and re-verify) or the claim is outdated (update or refute it).`,
+            source: "verify:stale",
+            sourceRef: r.memoryId,
+            rationale: `Memory ${r.memoryId.slice(0, 8)} went ${r.before} → STALE during verification.`,
+        });
+    }
+    // CLOUD_DESIGN consensus input: one verification_report event per run,
+    // anchored to the repo HEAD so the server can aggregate "N machines
+    // confirm memory X PASSes at sha Y".
+    let head = null;
+    try {
+        head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    }
+    catch {
+        // not a git repo (or no commits yet) — report without an anchor
+    }
+    for (const r of results) {
+        const ran = r.outcomes.filter((o) => o.result === "PASS" || o.result === "FAIL");
+        if (!ran.length)
+            continue; // nothing machine-checkable ran; no report
+        store.recordEvent("verification_report", r.memoryId, {
+            head,
+            status: r.after,
+            confidence: r.confidenceAfter,
+            pass: ran.every((o) => o.result === "PASS"),
+            deep: Boolean(opts.deep),
+        });
+    }
+    return {
+        checked: results.length,
+        verified: results.filter((r) => r.after === "VERIFIED").length,
+        stale: results.filter((r) => r.after === "STALE").length,
+        unchanged: results.filter((r) => r.after === r.before).length,
+        decayed: results.filter((r) => r.decayed).length,
+        results,
+    };
+}
+//# sourceMappingURL=engine.js.map

package/dist/verify/hooks.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Git hook installer (Phase 3) — re-verify memory on every pull/checkout/merge
+ * so agents never see a stale green checkmark.
+ *
+ * Also installs a post-commit CAPTURE hook: each new commit is mined for
+ * memory-worthy signals (decisions, gotchas, failed approaches). Candidates go
+ * to the proposal queue and the committer gets a gentle nudge to review —
+ * capture stays human-gated, it just stops depending on humans remembering
+ * to run `dim mine`.
+ *
+ * Hooks are additive: if a hook already exists without our marker, we append;
+ * existing logic is never clobbered.
+ */
+export declare const HOOK_MARKER = "# >>> aidimag verify hook >>>";
+export declare const CAPTURE_HOOK_MARKER = "# >>> aidimag capture hook >>>";
+export declare const BRANCH_HOOK_MARKER = "# >>> aidimag branch hook >>>";
+export declare const PRECOMMIT_HOOK_MARKER = "# >>> aidimag check hook >>>";
+export declare const KNOWLEDGE_HOOK_MARKER = "# >>> aidimag knowledge hook >>>";
+export interface HookInstallResult {
+    installed: string[];
+    alreadyPresent: string[];
+    skipped: string[];
+}
+export declare function installGitHooks(repoRoot: string): HookInstallResult;

package/dist/verify/hooks.js

@@ -0,0 +1,125 @@
+/**
+ * Git hook installer (Phase 3) — re-verify memory on every pull/checkout/merge
+ * so agents never see a stale green checkmark.
+ *
+ * Also installs a post-commit CAPTURE hook: each new commit is mined for
+ * memory-worthy signals (decisions, gotchas, failed approaches). Candidates go
+ * to the proposal queue and the committer gets a gentle nudge to review —
+ * capture stays human-gated, it just stops depending on humans remembering
+ * to run `dim mine`.
+ *
+ * Hooks are additive: if a hook already exists without our marker, we append;
+ * existing logic is never clobbered.
+ */
+import { chmodSync, existsSync, readFileSync, writeFileSync, appendFileSync, mkdirSync } from "node:fs";
+import path from "node:path";
+export const HOOK_MARKER = "# >>> aidimag verify hook >>>";
+export const CAPTURE_HOOK_MARKER = "# >>> aidimag capture hook >>>";
+export const BRANCH_HOOK_MARKER = "# >>> aidimag branch hook >>>";
+export const PRECOMMIT_HOOK_MARKER = "# >>> aidimag check hook >>>";
+export const KNOWLEDGE_HOOK_MARKER = "# >>> aidimag knowledge hook >>>";
+const VERIFY_HOOK_NAMES = ["post-merge", "post-checkout", "post-rewrite"];
+const CAPTURE_HOOK_NAME = "post-commit";
+const BRANCH_PUSH_HOOK_NAME = "pre-push";
+const PRECOMMIT_HOOK_NAME = "pre-commit";
+const KNOWLEDGE_HOOK_NAME = "post-merge";
+function hookBlock() {
+    return [
+        HOOK_MARKER,
+        "# Re-verifies aidimag memories against the new repo state (cheap tier only).",
+        "command -v dim >/dev/null 2>&1 && dim verify --quiet || true",
+        "# <<< aidimag verify hook <<<",
+        "",
+    ].join("\n");
+}
+function captureHookBlock() {
+    return [
+        CAPTURE_HOOK_MARKER,
+        "# Mines the new commit for memory candidates (queued for review, never auto-saved).",
+        "command -v dim >/dev/null 2>&1 && dim mine --quiet || true",
+        "# <<< aidimag capture hook <<<",
+        "",
+    ].join("\n");
+}
+/** post-checkout: warn (never block) when a new branch breaks the team convention. */
+function branchWarnHookBlock() {
+    return [
+        BRANCH_HOOK_MARKER,
+        "# Warns when the branch name breaks the team convention (tickets.branch in .aidimag/config.json).",
+        'if [ "$3" = "1" ]; then command -v dim >/dev/null 2>&1 && dim branch-check --warn || true; fi',
+        "# <<< aidimag branch hook <<<",
+        "",
+    ].join("\n");
+}
+/** pre-push: block pushes of non-conforming branches when enforce mode is "push". */
+function branchPushHookBlock() {
+    return [
+        BRANCH_HOOK_MARKER,
+        "# Blocks pushing branches that break the team convention (tickets.branch.enforce = push).",
+        "command -v dim >/dev/null 2>&1 && { dim branch-check --push || exit 1; } || true",
+        "# <<< aidimag branch hook <<<",
+        "",
+    ].join("\n");
+}
+/** pre-commit: scan the staged diff against memory/guardrails. No-op unless
+ *  preCommitCheck is enabled in .aidimag/config.json (warn or block). */
+function preCommitHookBlock() {
+    return [
+        PRECOMMIT_HOOK_MARKER,
+        "# Scans the staged diff against active memories + guardrails (shift-left verifier).",
+        "# Behavior follows preCommitCheck in .aidimag/config.json (unset = no-op).",
+        "command -v dim >/dev/null 2>&1 && { dim check --pre-commit || exit 1; } || true",
+        "# <<< aidimag check hook <<<",
+        "",
+    ].join("\n");
+}
+/** post-merge: catch-up summarization of any docs sitting in the knowledge inbox. */
+function knowledgeHookBlock() {
+    return [
+        KNOWLEDGE_HOOK_MARKER,
+        "# Summarizes newly-pulled knowledge-inbox docs into review proposals (best-effort, never blocks).",
+        "command -v dim >/dev/null 2>&1 && dim knowledge sync >/dev/null 2>&1 || true",
+        "# <<< aidimag knowledge hook <<<",
+        "",
+    ].join("\n");
+}
+export function installGitHooks(repoRoot) {
+    const gitDir = path.join(repoRoot, ".git");
+    const result = { installed: [], alreadyPresent: [], skipped: [] };
+    if (!existsSync(gitDir)) {
+        result.skipped = [...VERIFY_HOOK_NAMES, CAPTURE_HOOK_NAME];
+        return result;
+    }
+    const hooksDir = path.join(gitDir, "hooks");
+    mkdirSync(hooksDir, { recursive: true });
+    const install = (name, marker, block) => {
+        const file = path.join(hooksDir, name);
+        if (existsSync(file)) {
+            const current = readFileSync(file, "utf8");
+            if (current.includes(marker)) {
+                result.alreadyPresent.push(name);
+                return;
+            }
+            appendFileSync(file, `\n${block}`);
+        }
+        else {
+            writeFileSync(file, `#!/bin/sh\n${block}`);
+        }
+        chmodSync(file, 0o755);
+        result.installed.push(name);
+    };
+    for (const name of VERIFY_HOOK_NAMES)
+        install(name, HOOK_MARKER, hookBlock());
+    install(CAPTURE_HOOK_NAME, CAPTURE_HOOK_MARKER, captureHookBlock());
+    // branch convention (T1.5): warn at creation (post-checkout), gate at push
+    install("post-checkout", BRANCH_HOOK_MARKER, branchWarnHookBlock());
+    install(BRANCH_PUSH_HOOK_NAME, BRANCH_HOOK_MARKER, branchPushHookBlock());
+    // shift-left verifier: scan staged diff before the commit lands (opt-in via config)
+    install(PRECOMMIT_HOOK_NAME, PRECOMMIT_HOOK_MARKER, preCommitHookBlock());
+    // knowledge catch-up: summarize freshly-pulled inbox docs after a merge/pull
+    install(KNOWLEDGE_HOOK_NAME, KNOWLEDGE_HOOK_MARKER, knowledgeHookBlock());
+    result.installed = [...new Set(result.installed)];
+    result.alreadyPresent = [...new Set(result.alreadyPresent)].filter((n) => !result.installed.includes(n));
+    return result;
+}
+//# sourceMappingURL=hooks.js.map

package/dist/verify/runners.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Evidence runners.
+ *
+ * Cheap tier (STATIC_CHECK, COMMIT_REF) runs on every `git pull` via hooks.
+ * Expensive tier (TEST_RESULT, EXEC_TRACE) runs only with deep=true
+ * (`dim verify --deep`) so hook-triggered verification stays fast.
+ */
+import type { Evidence, EvidenceResult } from "../types.js";
+export interface RunOutcome {
+    evidenceId: string;
+    type: Evidence["type"];
+    result: EvidenceResult | "SKIPPED";
+    detail: string;
+}
+export interface RunOptions {
+    /** Run the expensive tier (TEST_RESULT, EXEC_TRACE). Default false — cheap tier only. */
+    deep?: boolean;
+    /**
+     * Trust gate for executable evidence (STATIC_CHECK/TEST_RESULT/EXEC_TRACE):
+     * payloads run shell commands, so only locally-approved ones may execute.
+     * Returns true if the payload is approved on this machine. Omitted = trust
+     * everything (unit tests / explicit --trust runs).
+     */
+    isTrusted?: (payload: string) => boolean;
+}
+export declare function runEvidence(ev: Evidence, repoRoot: string, opts?: RunOptions): RunOutcome;

package/dist/verify/runners.js

@@ -0,0 +1,193 @@
+/**
+ * Evidence runners.
+ *
+ * Cheap tier (STATIC_CHECK, COMMIT_REF) runs on every `git pull` via hooks.
+ * Expensive tier (TEST_RESULT, EXEC_TRACE) runs only with deep=true
+ * (`dim verify --deep`) so hook-triggered verification stays fast.
+ */
+import { execFileSync, execSync } from "node:child_process";
+const STATIC_CHECK_TIMEOUT_MS = 15_000;
+const DEEP_TIMEOUT_MS = 120_000; // TEST_RESULT / EXEC_TRACE
+/** STATIC_CHECK: payload is a shell command; exit 0 = claim holds. */
+function runStaticCheck(ev, repoRoot) {
+    try {
+        execSync(ev.payload, {
+            cwd: repoRoot,
+            timeout: STATIC_CHECK_TIMEOUT_MS,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return { evidenceId: ev.id, type: ev.type, result: "PASS", detail: "exit 0" };
+    }
+    catch (err) {
+        const e = err;
+        if (e.killed) {
+            return {
+                evidenceId: ev.id,
+                type: ev.type,
+                result: "UNKNOWN",
+                detail: `timed out after ${STATIC_CHECK_TIMEOUT_MS}ms`,
+            };
+        }
+        return {
+            evidenceId: ev.id,
+            type: ev.type,
+            result: "FAIL",
+            detail: `exit ${e.status ?? "?"}`,
+        };
+    }
+}
+/**
+ * COMMIT_REF: payload is a commit sha (optionally "sha:path,path" to also
+ * check the anchored files haven't changed since that commit).
+ * - sha missing from history → FAIL (rebased away / rewritten)
+ * - anchored files changed since sha → FAIL (claim may have drifted)
+ * - otherwise → PASS
+ */
+function runCommitRef(ev, repoRoot) {
+    const [sha, pathSpec] = ev.payload.split(":", 2);
+    const git = (args) => execFileSync("git", args, { cwd: repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    try {
+        git(["cat-file", "-e", `${sha}^{commit}`]);
+    }
+    catch {
+        return {
+            evidenceId: ev.id,
+            type: ev.type,
+            result: "FAIL",
+            detail: `commit ${sha.slice(0, 8)} no longer exists in history`,
+        };
+    }
+    // is the commit still reachable from HEAD? (revert/branch-switch detection)
+    try {
+        git(["merge-base", "--is-ancestor", sha, "HEAD"]);
+    }
+    catch {
+        return {
+            evidenceId: ev.id,
+            type: ev.type,
+            result: "FAIL",
+            detail: `commit ${sha.slice(0, 8)} is not an ancestor of HEAD`,
+        };
+    }
+    if (pathSpec) {
+        const paths = pathSpec.split(",").map((p) => p.trim()).filter(Boolean);
+        for (const p of paths) {
+            if (p.startsWith("/") || p.includes("..")) {
+                return {
+                    evidenceId: ev.id,
+                    type: ev.type,
+                    result: "FAIL",
+                    detail: "invalid path in COMMIT_REF evidence",
+                };
+            }
+        }
+        try {
+            const changed = git(["diff", "--name-only", sha, "HEAD", "--", ...paths]).trim();
+            if (changed) {
+                return {
+                    evidenceId: ev.id,
+                    type: ev.type,
+                    result: "FAIL",
+                    detail: `anchored file(s) changed since ${sha.slice(0, 8)}: ${changed.split("\n").slice(0, 3).join(", ")}`,
+                };
+            }
+        }
+        catch {
+            return { evidenceId: ev.id, type: ev.type, result: "UNKNOWN", detail: "diff failed" };
+        }
+    }
+    return { evidenceId: ev.id, type: ev.type, result: "PASS", detail: `${sha.slice(0, 8)} reachable from HEAD` };
+}
+/**
+ * TEST_RESULT: payload is a test command (e.g. "npm test -- --run auth").
+ * Expensive tier — only runs when deep=true. Exit 0 = the claim holds.
+ */
+function runTestResult(ev, repoRoot) {
+    try {
+        execSync(ev.payload, {
+            cwd: repoRoot,
+            timeout: DEEP_TIMEOUT_MS,
+            stdio: ["ignore", "pipe", "pipe"],
+            env: { ...process.env, CI: "1" }, // non-interactive, no watch mode
+        });
+        return { evidenceId: ev.id, type: ev.type, result: "PASS", detail: "test command exit 0" };
+    }
+    catch (err) {
+        const e = err;
+        if (e.killed) {
+            return { evidenceId: ev.id, type: ev.type, result: "UNKNOWN", detail: `timed out after ${DEEP_TIMEOUT_MS}ms` };
+        }
+        return { evidenceId: ev.id, type: ev.type, result: "FAIL", detail: `test command exit ${e.status ?? "?"}` };
+    }
+}
+/**
+ * EXEC_TRACE: payload is "command :: expected-output-regex".
+ * Runs the command and matches stdout against the regex — the claim holds iff
+ * the observed behavior matches. Without " :: ", exit 0 = PASS.
+ * Sandboxing note: v1 confines execution to the repo root with a hard timeout;
+ * container/VM isolation is a later hardening step.
+ */
+function runExecTrace(ev, repoRoot) {
+    const sep = " :: ";
+    const idx = ev.payload.indexOf(sep);
+    const cmd = idx >= 0 ? ev.payload.slice(0, idx) : ev.payload;
+    const expect = idx >= 0 ? ev.payload.slice(idx + sep.length) : null;
+    try {
+        const stdout = execSync(cmd, {
+            cwd: repoRoot,
+            timeout: DEEP_TIMEOUT_MS,
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        if (expect === null) {
+            return { evidenceId: ev.id, type: ev.type, result: "PASS", detail: "exec exit 0" };
+        }
+        const re = new RegExp(expect, "m");
+        return re.test(stdout)
+            ? { evidenceId: ev.id, type: ev.type, result: "PASS", detail: `output matched /${expect}/` }
+            : { evidenceId: ev.id, type: ev.type, result: "FAIL", detail: `output did not match /${expect}/` };
+    }
+    catch (err) {
+        const e = err;
+        if (e.killed) {
+            return { evidenceId: ev.id, type: ev.type, result: "UNKNOWN", detail: `timed out after ${DEEP_TIMEOUT_MS}ms` };
+        }
+        return { evidenceId: ev.id, type: ev.type, result: "FAIL", detail: `exec exit ${e.status ?? "?"}` };
+    }
+}
+const EXECUTABLE_TYPES = new Set(["STATIC_CHECK", "TEST_RESULT", "EXEC_TRACE"]);
+export function runEvidence(ev, repoRoot, opts = {}) {
+    // Supply-chain guard: evidence that arrived via team sync is shell code
+    // someone else wrote. It never executes until approved on this machine
+    // (`dim verify --trust` to review & approve).
+    if (EXECUTABLE_TYPES.has(ev.type) && opts.isTrusted && !opts.isTrusted(ev.payload)) {
+        return {
+            evidenceId: ev.id,
+            type: ev.type,
+            result: "SKIPPED",
+            detail: "untrusted (synced) evidence — inspect & approve with `dim verify --trust`",
+        };
+    }
+    switch (ev.type) {
+        case "STATIC_CHECK":
+            return runStaticCheck(ev, repoRoot);
+        case "COMMIT_REF":
+            return runCommitRef(ev, repoRoot);
+        case "HUMAN_ATTESTED":
+            // human word is taken as-is; confidence decay handles its aging
+            return { evidenceId: ev.id, type: ev.type, result: "PASS", detail: "human attested" };
+        case "TEST_RESULT":
+            return opts.deep
+                ? runTestResult(ev, repoRoot)
+                : { evidenceId: ev.id, type: ev.type, result: "SKIPPED", detail: "expensive tier — use --deep" };
+        case "EXEC_TRACE":
+            return opts.deep
+                ? runExecTrace(ev, repoRoot)
+                : { evidenceId: ev.id, type: ev.type, result: "SKIPPED", detail: "expensive tier — use --deep" };
+        case "TICKET_REF":
+            // annotation-only provenance (TICKETS_DESIGN open question #2: ticket
+            // lifecycle is a weaker signal than code evidence — never flips status)
+            return { evidenceId: ev.id, type: ev.type, result: "SKIPPED", detail: `ticket ${ev.payload} (provenance annotation)` };
+    }
+}
+//# sourceMappingURL=runners.js.map

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "aidimag",
+  "version": "1.0.0",
+  "description": "Persistent, verified memory for AI coding agents. CLI: dim.",
+  "type": "module",
+  "license": "SEE LICENSE IN LICENSE",
+  "author": "Anup Khanal",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/anupkhanal/aidimag.git"
+  },
+  "homepage": "https://github.com/anupkhanal/aidimag#readme",
+  "bugs": {
+    "url": "https://github.com/anupkhanal/aidimag/issues"
+  },
+  "bin": {
+    "dim": "./dist/cli/index.js",
+    "aidimag": "./dist/cli/index.js"
+  },
+  "main": "./dist/index.js",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/test",
+    "!dist/**/*.map",
+    "LICENSE",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "mcp": "node dist/mcp/server.js",
+    "pretest": "tsc",
+    "test": "node --test dist/test/*.test.js",
+    "prepublishOnly": "npm run build && npm test",
+    "docs:dev": "vitepress dev docs",
+    "docs:build": "vitepress build docs",
+    "docs:preview": "vitepress preview docs"
+  },
+  "keywords": [
+    "mcp",
+    "ai-agents",
+    "memory",
+    "codebase",
+    "claude",
+    "cursor",
+    "copilot",
+    "knowledge-base",
+    "cli"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "better-sqlite3": "^11.0.0",
+    "commander": "^12.0.0",
+    "mammoth": "^1.11.0",
+    "pdf-parse": "^1.1.1",
+    "sqlite-vec": "^0.1.9",
+    "uuid": "^12.0.1",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.0",
+    "@types/node": "^20.0.0",
+    "typescript": "^5.5.0",
+    "vitepress": "2.0.0-alpha.17"
+  },
+  "overrides": {
+    "esbuild": "^0.28.1"
+  }
+}